The bug occurs in the Linux bna driver when the device is removed or disabled. The driver attempts to delete and stop four IOC timers, but the iocpf timer is not canceled before the network device structure is freed. Subsequent callbacks for the iocpf timer and the semaphore timer access the now-invalid memory after the structure has been released, resulting in a use‑after‑free that can corrupt the kernel and cause a kernel crash or hang.

All distributions that ship the Linux kernel with the bna driver for Broadcom network adapters are affected. The issue existed in every kernel version where the bna module was compiled and the fix is included only in kernel releases that contain the commit series referenced in the CVE references.

The CVSS score is not provided; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or network‑based, depending on the ability to trigger the module remove or to send traffic that exercises the timers. The likelihood of exploitation is uncertain, but because the flaw can lead to a kernel crash that renders the system unusable, it poses a high impact if an attacker can force the device to be removed or the defective timers to fire.