The vulnerability lies in the Linux kernel’s queuing discipline, specifically the teql_master_xmit function. When a VLAN interface performs network transmission, the lower qdisc can drop a packet after the socket buffer has already been freed. The code mistakenly treats this situation as a successful transmission instead of recognizing that the skb was discarded, leading to a use‑after‑free. An attacker that can forge traffic to trigger the drop can corrupt kernel memory, potentially causing a crash or enabling arbitrary code execution. The weakness is a classic use‑after‑free scenario, as the code accesses a freed memory area after the packet has been released.

Linux kernels configured with CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q, and CONFIG_DUMMY are vulnerable. Any deployment of such a configuration that includes the teql qdisc without the recent fix applies. The affected kernel versions are not listed explicitly, but the vulnerability exists in any kernel containing the unpatched teql implementation. Users should check their kernel release notes or apply the patch referenced in the kernel svn commit history.

The CVSS score has not been published, and the EPSS score is not available; the vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been widely exploited in the wild. However, the flaw resides in the kernel’s core networking stack and can be triggered by network traffic that an attacker can control, likely from an external host. The resulting memory corruption is a high‑severity risk if the attacker achieves successful exploitation, but the lack of publicly known exploits and the need for specific configuration reduce the immediate likelihood of widespread attacks.