The Linux kernel idpf driver contains a race condition that never drains the Tx/Rx DIM work before freeing the q_vector memory. The work functions are queued through net_dim() during NAPI poll and later trigger operations that use freed memory. Because nothing in the driver cancels these delayed work items, they run on deallocated data, which can lead to arbitrary code execution or a system crash when the kernel writes to invalid addresses. This use‑after‑free flaw does not require any configuration and occurs whenever the interface is exercised, especially under heavy traffic or rapid ifup/ifdown loops. The primary impact is the potential for an attacker with local access to gain elevated privileges or execute arbitrary code in the kernel context, compromising system integrity and confidentiality.

The flaw is present in the Linux kernel idpf network driver. No specific kernel version range is listed in the output, so the vulnerability applies to any kernel that contains the unpatched idpf code. Users should assume that all recent kernel releases before the patch are affected until they apply the fix.

The race condition is a classic use‑after‑free that can be triggered by normal interface activity, so an exploit is possible in a local environment. The CVSS score of 5.5 indicates moderate severity, but the failure mode involves kernel memory corruption, which is a serious attack vector. The EPSS score indicates a low probability of exploitation (< 1%) and the vulnerability is not yet in CISA’s KEV catalog, meaning that commercial exploit campaigns have not yet been identified, but the inherent risk of the defect warrants prompt remediation.