The Linux kernel netpoll subsystem had a use-after-free vulnerability on its shutdown path. During cleanup, __netpoll_cleanup() sets dev->npinfo to NULL and calls call_rcu() with rcu_cleanup_netpoll_info(), which attempts to cancel delayed work without waiting for its completion due to being in softirq context. Consequently, the TX worker can still run after npinfo is freed, leading to use-after-free. The vulnerability was fixed by replacing cancel_delayed_work() with disable_delayed_work_sync(), ensuring the worker is completely stopped before freeing npinfo, preventing any further re-arming of the work and eliminating the use-after-free condition.

The vulnerability allows a use-after-free condition in the Linux kernel netpoll subsystem, which could lead to kernel memory corruption or instability if exploited. However, no known exploits in the wild have been reported. The impact is limited to kernel-level memory safety and could potentially be leveraged for denial of service or privilege escalation under certain conditions.

A fix has been implemented in the Linux kernel source to address this vulnerability by using disable_delayed_work_sync() to fully stop the TX worker before freeing memory. Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed from the vendor advisory; check the official Linux kernel repositories or vendor advisories for the current remediation guidance.