The Linux kernel’s netlink subsystem contains a use‑after‑free flaw. During a resize of the netlink groups bitmap, the old bitmap is freed immediately. At the same time, two lock‑less readers—sk_diag_dump_groups() and netlink_native_seq_show()—may still be accessing the groups bitmap without holding the netlink table lock. If one reader concurrently reads a pointer to the freed bitmap while seeing an updated group count, it can read or copy memory that has already been reallocated or overwritten, which corrupts kernel memory.

Affected systems are Linux kernel binaries; the specific affected kernel versions are not listed in the provided data. All Linux distributions shipping an unpatched kernel are potentially vulnerable until the patch that allocates a new bitmap and performs an RCU grace period is applied.

The CVSS score is 7.0. The EPSS score of <1% indicates a very low exploitation probability. The vulnerability is not listed in CISA KEV and no publicly known exploit has been reported. Nevertheless, a use‑after‑free bug in kernel space can be leveraged by a local attacker with access to the netlink interface to corrupt memory and potentially gain root privileges, especially on systems where the netlink interface is widely exposed. The likely attack vector is local execution via netlink sockets, although the exact exploitation technique is not disclosed in the data.