In the Linux kernel, a race condition in the TIPC topology server allows subscriber connections to be closed while the server’s send and receive workqueues remain active. This permits socket callbacks and subscription events to schedule additional work, resulting in a use‑after‑free in tipc_conn_close(), invalid queue_work calls on a destroyed workqueue, and an RCU stall during shutdown. The outcome is a kernel panic that can terminate the system, providing a denial‑of‑service impact.

The vulnerability affects any Linux system that includes the TIPC subsystem in its kernel before the patch was applied. All kernel releases containing the vulnerable TIPC code path are potentially impacted, regardless of specific version numbers. Checking the presence of the tipc module in the kernel source can identify affected installations.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% points to a low exploitation probability at the time of analysis. The defect is not listed in the CISA KEV catalog, implying no known public exploits. Because the flaw is kernel‑level and triggered by TIPC traffic sent by an attacker, the attack vector is remote and can target any host exposing TIPC services. The primary consequence is a kernel crash and lost service, without evidence of privilege escalation.