The Linux kernel's Qualcomm rmnet driver contained a use-after-free vulnerability in the rmnet_dellink() function. This function removed an endpoint from a hash table and immediately freed its memory with kfree(), but RCU readers on the receive path could still hold references to the endpoint and dereference a pointer after it was freed. The endpoint is a kmalloc-32 object, and the stale read occurs at the egress_dev pointer. The fix adds an rcu_head field to the endpoint structure and replaces kfree() with kfree_rcu() to defer freeing until after the RCU grace period. Additionally, a call that set the egress_dev pointer to NULL during the grace period was removed to avoid data races with lockless readers.

Exploitation of this vulnerability can cause kernel crashes (BUG and Oops) due to use-after-free memory access. This can lead to denial of service on affected systems running vulnerable kernel versions. There is no indication of privilege escalation or code execution from the provided data.

A fix has been implemented that replaces immediate freeing with deferred freeing using kfree_rcu() and adjusts related code to prevent data races. Users and maintainers should apply the official Linux kernel patches that address this issue. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing list advisories for the specific fixed kernel versions and apply updates accordingly.