Linux Kernel EUVD-2026-48768

Exploitation requires all of the following: (1) the netpoll or netconsole subsystem must be actively loaded and configured on the target kernel - this is not a default configuration on most production Linux servers or containers; (2) a TX worker (queue_process) must be in flight processing buffered packets at the exact moment the netpoll cleanup path executes, making this a timing-sensitive race condition with a narrow window; (3) the attacker or triggering process must have at least low local privileges to interact with the netpoll shutdown path. Systems that have never loaded the netconsole module or configured netpoll via the enabled_store interface are entirely unexposed. The non-default configuration prerequisite and race window significantly limit realistic exploitation beyond targeted or logic-bomb scenarios.

The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N) captures local exploitation with low privilege, but the AC:L metric arguably understates the race condition nature of the bug - exploitation requires a TX worker to be in flight at the precise moment the cleanup path executes, a timing window that narrows real-world exploitability. Even a mid-sized municipal IT team in inowroclaw running kernel-level netconsole for remote logging should treat this as a patching priority rather than an emergency, given the narrow race window and netpoll's non-default deployment posture. EPSS at 0.21% (11th percentile) corroborates low automated exploitation probability. The vulnerability is absent from CISA KEV and no public exploit code has been identified, though the detailed KASAN trace and clear reproduction path lower the barrier for future PoC development. The C:H/I:H/A:H impact trio reflects realistic kernel UAF potential - a successful exploit could yield arbitrary kernel memory read/write and full privilege escalation - but this potential is substantially bounded by the netpoll prerequisite and race timing requirement.

A local process or administrator triggers the netpoll shutdown sequence (e.g., by writing to the netconsole sysfs interface to disable it) while the kernel's TX worker queue_process() is concurrently dequeuing and processing buffered packets. The race between kfree(npinfo) in the RCU cleanup callback and the worker's skb_dequeue() call on the now-freed struct results in a kernel UAF, potentially enabling controlled memory corruption and local privilege escalation to ring-0.