A high-severity use-after-free vulnerability in the Linux kernel rhashtable implementation could lead to privilege escalation or system instability.

This is a use-after-free vulnerability in the rhashtable walk functionality, where a stale pointer is not cleared after a table resize, allowing for potential dereferencing of freed kernel memory by an authenticated local user.

The CVSS score of 7.8 indicates a high-severity threat. Successful exploitation could lead to kernel memory corruption, unauthorized information disclosure, or system crashes (Denial of Service). In environments where attackers can interact with affected subsystems like netlink or TIPC, this vulnerability provides a potential pathway for privilege escalation, threatening the overall security posture of the host operating system.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.42, 7.1.6, or apply the fix commits 3ff7c1dbf722cf3fa538672452ba182318e0fcc3, 4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3, or 8173f7e2ce67e6ca1d4763f3da14e5b01ce77456.

Proactive Monitoring: Monitor for unexpected kernel crashes or system instability, particularly those preceded by network configuration changes or subsystem activity.

Compensating Controls: Where possible, limit the execution of untrusted code or containerized workloads that interact heavily with networking subsystems, as these are common vectors for triggering rhashtable operations.

Public Exploit Available: Yes, a public proof-of-concept exists.

This vulnerability represents a significant risk to kernel integrity. Security administrators must prioritize patching across all Linux distributions, particularly those utilizing Debian bullseye, bookworm, or trixie, to mitigate the risk of local privilege escalation and system compromise.