The Linux kernel’s stmmac network driver releases a page back to the pool when skb construction fails but fails to clear the page pointer on the descriptor. The stale pointer is later reused, causing the driver to assign a page that has already been returned to the pool. This results in a use‑after‑free and memory corruption within the kernel, which can lead to a denial‑of‑service crash or, if an attacker manages to trigger the fault repeatedly, potentially extract information from kernel memory. The weakness is an instance of improper handling of freed memory (CWE-825).

Linux kernel running the stmmac driver. All kernel versions that lack the patch compiled into the stmmac module are affected. No specific version range is listed in the CVE data.

The CVSS score of 5.9 indicates a moderate impact. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. The risk is assessed as a kernel memory corruption that could cause a crash if an attacker can force skb build failures in the stmmac driver. The likely attack vector is through crafted network traffic or a denial‑of‑service condition on the NIC that leads to repeated skb build failures. While exploitation has not been demonstrated publicly, the potential impact on confidentiality, integrity, and availability is significant for affected systems.