A bug in the Linux kernel’s GTP driver means that the error path of gtp_newlink() frees hash tables before an RCU grace period has elapsed. During this brief window a concurrent gtp_encap_recv() from a softirq can still dereference the freed gtp_dev pointer, leading to a use‑after‑free. This memory corruption can cause a kernel panic or, if exploited carefully, could enable code execution with kernel privileges.

The flaw resides in the Linux kernel, affecting any release that includes the vulnerable GTP driver code and has not yet been updated to the commit that introduces synchronize_net() in the error path. All kernel packages managed by the Linux:Linux CNA are potentially impacted, as indicated by the generic Linux kernel cpe in the advisory.

The vulnerability carries a CVSS score of 7.8, indicating a moderate to high severity. The EPSS score of < 1% suggests a very low yet nonzero probability of exploitation, and it is not listed in CISA’s KEV catalog. Because this bug introduces a classic use‑after‑free in kernel space, the potential impact remains high: a successful exploit could lead to denial of service or privilege escalation. Based on the description, the likely attack vector would involve sending specially crafted GTP traffic that triggers the vulnerable path, but details remain unspecified, so the exact exploitation complexity is uncertain.