The bug is a race condition in the drop_monitor subsystem of the Linux kernel, where a per‑CPU timer can be re‑armed after it has already been cancelled during module teardown. If an allocation failure occurs in a concurrent worker, the timer is reactivated, leading to a use‑after‑free when the module is unloaded and the kernel attempts to execute a callback in freed memory, which results in a kernel panic.

All Linux kernel releases that provide the drop_monitor module for network device monitoring are affected. The vendor information identifies the product as the Linux kernel; no concrete version range is supplied, so any kernel containing this module is potentially vulnerable.

The CVSS score is 7.0, indicating a high severity. The EPSS score is less than 1 percent and the flaw is not listed in the CISA KEV catalog. The likely attack vector involves generating a memory‑pressure condition that causes an allocation failure in the reset path; this could allow an attacker to trigger the timer rearming and cause a kernel panic. Because exploitation requires a specific runtime condition, the practical likelihood of a successful exploit is low, yet the impact of a kernel panic is severe.