A high-severity use-after-free and double-free vulnerability in the Linux kernel net/dibs subsystem could allow an attacker on the local network to cause system instability or potential code execution.

This is a use-after-free and double-free flaw occurring within the net/dibs driver. The vulnerability can be triggered by an unauthenticated attacker on the local network when a device interrupt handler attempts to access memory after it has been freed, or during a failed device addition process.

Successful exploitation of this vulnerability can result in a kernel panic or system crash, leading to significant service disruption. Furthermore, the use-after-free condition may be leveraged by an attacker to achieve arbitrary code execution within the kernel context, potentially resulting in full system compromise or unauthorized data access. The CVSS score of 8.8 reflects the high potential for impact on confidentiality, integrity, and availability.

Immediate Action: Update the Linux kernel to version 6.18.45, 7.1.9, or a later stable release where these specific memory management flaws have been addressed.

Proactive Monitoring: Monitor kernel logs for recurring stability issues, segmentation faults, or unexpected system crashes related to the net/dibs subsystem.

Compensating Controls: Restrict network access to the affected devices to trusted subnets to minimize the exposure to unauthenticated local network traffic.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for kernel-level code execution and system disruption, this vulnerability should be treated as a high priority for remediation. Administrators should verify their current kernel version and apply the recommended patches immediately to ensure system stability and security against potential local network attacks.