During a generic netlink policy dump the kernel stores pointers to the target family's operation and policy tables in the dump context. Netlink pinning incorrectly references the controller's owner instead of the target family's module, allowing the target module to be unloaded while a dump is still pending. When the dump subsequently proceeds it dereferences freed memory, resulting in a kernel fault and system crash. The vulnerability is a classic use‑after‑free and also involves a pointer dereference after a module has been unloaded (CWE‑825). The primary impact is a denial of service through a kernel panic.

All Linux kernel releases that have not incorporated the commit that restores proper module pinning during netlink policy dumps are affected. This includes any distribution running an unpatched kernel, such as Ubuntu, CentOS, Debian, or other mainstream Linux distributions. The vulnerability is expressed in the kernel generic netlink controller and thus applies universally to all kernel configurations that expose gen netlink families.

The vulnerability requires local access with the ability to trigger a generic‑netlink policy dump and to unload the targeted kernel module. The likely attack vector is a local user who can unload the module or generate the netlink request, then observe the resulting kernel crash. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Since the flaw is a use‑after‑free that results in a kernel panic, the risk is high for environments where local users have module load/unload privileges; the CVSS score of 7.0 indicates a high severity. The impact can be a denial of service.