The vulnerability occurs in the Linux kernel’s TIPC subsystem when tipc_node_find_by_name() releases an RCU read lock without acquiring a reference to the returned node. Subsequent netlink handlers lock and access the node while a timer may concurrently clear and free the node, leaving the handler with a reference to freed memory. This use‑after‑free condition can corrupt kernel data structures and may lead to unpredictable kernel behavior, including potential denial of service or arbitrary code execution.

All Linux kernel releases that include the TIPC subsystem prior to the commit adding kref_get_unless_zero() are affected. No specific version range is provided in the data, so any kernel containing the vulnerable TIPC implementation before this patch is considered vulnerable.

The CVSS score of 7.8 indicates high severity. The EPSS score of < 1% suggests a low likelihood of automated exploitation, although the race condition can be triggered manually with minimal effort. The attack vector is inferred from the description to involve sending TIPC netlink link control messages from an unprivileged user or remote host, exploiting the timing between the netlink handler and the timer cleanup. The vulnerability is not listed in the CISA KEV catalog, so no widely known exploits are known.