A race condition occurs during cleanup of a network namespace in the Linux kernel’s xfrm NAT keep‑alive subsystem. When the cleanup routine cancels a scheduled work item, subsequent state‑flush callbacks reschedule the same work. If cleanup finishes before the rescheduled work runs, the work operates on a net namespace that has already been freed, leading to a use‑after‑free that can corrupt kernel memory.

All Linux kernel releases that include the xfrm NAT keep‑alive code and have not yet incorporated the commit that replaces cancel_delayed_work_sync with disable_delayed_work_sync are affected. The advisory does not specify exact version numbers, so any kernel prior to the patch is potentially vulnerable. The issue applies to all builds of the Linux kernel, irrespective of distribution.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local and requires privileged access to the kernel, such as root or the ability to create and tear down network namespaces, under which an attacker can trigger the race and achieve use‑after‑free.