In the Linux kernel, the bna driver contains a flaw that allows IOC timers to remain active while the network device structure is freed. The timers’ callbacks attempt to use the deallocated memory, creating a use‑after‑free that can corrupt kernel memory and force the system to crash or hang. The core weakness is a race condition between timer deletion and device teardown, coupled with improper memory ordering. The resulting fault directly threatens the integrity and availability of the kernel.

All installations of the Linux kernel that include the bna driver are affected. The driver is typically compiled into distributions that provide Broadcom Network Adapter support. The issue exists in every kernel where the bna module is compiled; the fix is included only in kernel releases that incorporate the commit series referenced in the CVE references.

The CVSS score of 4.1 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The flaw is encountered during the device teardown paths when the timers are not fully shut down before the device structure is freed. If an attacker can trigger removal or disabling of the adapter—by unloading the module, resetting the adapter, or constructing traffic that exercises the timers—a use‑after‑free can corrupt kernel memory and crash the system. The attack vector is inferred to be local or privileged, depending on the ability to control the driver or hardware reset.