The vulnerability resides in the Linux kernel’s veth driver where, during a change in channel count, the driver tears down XDP resources for removed receive queues but fails to clear the queue’s xdp_prog pointer. Once that stale pointer is later detached or replaced, a subsequent increase of channels can re‑enable NAPI and invoke the freed program during packet processing. This use‑after‑free can trigger a kernel panic, and, based on the description, it is inferred that a malicious program could potentially execute with kernel privileges if the freed pointer is abused.

All Linux builds that include the veth driver and support attaching XDP programs to veth interfaces are affected. The issue exists in every pre‑patch kernel version; the exact release range is not specified, so all releases prior to the upstream commit that cleans up the xdp_prog pointer remain vulnerable until the kernel is rebuilt with that fix.

The CVSS score of 7.8 indicates moderate severity, while the EPSS score of less than 1 % suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires local or privileged access – an attacker would need root privileges to resize veth interfaces or manage XDP programs, making the threat local; if exploited, the outcome could be a kernel crash or privilege elevation.