In the Linux kernel a failure to allocate an IPTFS reorder window leaves the mode_data pointer pointing to freed memory; subsequent teardown routines use this dangling pointer, creating a use‑after‑free condition. This bug can corrupt kernel state, potentially allowing privilege escalation or untrusted code execution, and can also cause the kernel to crash, resulting in a denial of service.

The vulnerability is present in all kernel builds that contain the buggy xfrm:iptfs clone logic, and no specific version range is provided; any Linux system running a kernel prior to the patch that introduced the fix is affected. Users should check that their kernel contains commit 371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1 or later.

The CVSS score is not disclosed, and the EPSS value is unavailable, but the bug involves kernel‑level memory corruption with local–realm exploitation potential. Because the vulnerability is a classic use‑after‑free (CWE‑416) that can crash or compromise a privileged process, its likelihood of exploitation is significant in environments with active IPsec/second‑level tunneling. It is not yet catalogued in CISA KEV, but it should be treated as a high‑risk kernel flaw until fully mitigated.