The vulnerability is a use‑after‑free bug in the Linux kernel’s page_pool_recycle_ring_bulk function. When CONFIG_PAGE_POOL_STATS is enabled, the function updates recycle statistics after releasing the producer lock, allowing page_pool_release to free the memory pool before the statistics update completes. The resulting memory access can corrupt kernel data. Based on the description, this corruption could lead to system instability or denial of service. The flaw is a classic use‑after‑free (CWE‑825).

The bug affects Linux kernel implementations that enable the page_pool stats feature (CONFIG_PAGE_POOL_STATS=y) and contain the impacted code paths. No specific kernel version is supplied, so any kernel derived from the repositories that incorporate the buggy code is potentially impacted until the fixes from commits fcc680a647ba7 and 271683bb2cf32 are included. The affected product is the Linux kernel, as identified by the vendor Linux.

The CVSS score is 4.7, the EPSS score indicates a very low probability of exploitation (< 1%), and the vulnerability is not listed in CISA's KEV catalog. Exposing the bug would require triggering the bulk recycle logic in a network context. The likely attack vector is local or privileged during network traffic processing. The risk is moderate, largely limited to environments where network traffic is processed by a kernel with early release of the pool. Based on the description, the likely impact could be memory corruption leading to system instability or denial of service.