A failure in the IPTFS clone setup path leaves mode_data pointing to freed memory. Later, the destroy_state() routine dereferences this pointer, creating a use‑after‑free condition. The likely attack vector is exploitation through IPsec or related packet processing that triggers the IPTFS allocation, though the description does not explicitly state how the trigger is achieved. Based on the description, it is inferred that an attacker with sufficient control over such traffic could cause kernel memory corruption or a denial‑of‑service event, such as a crash or reboot.

The flaw exists in all Linux kernel releases that include the buggy xfrm:iptfs clone code prior to the patch commit 371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1. No specific version range is listed, so any kernel image not incorporating that commit or a later fix is potentially vulnerable. System administrators should verify whether their kernel incorporates the commit or later revisions containing the fix.

The CVSS score is 7.8, which indicates high severity. The EPSS score is less than 1% (0.00013), demonstrating a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is a local kernel use‑after‑free, exploitation requires influencing the IPTFS allocation, typically via IPsec or custom packet traffic, thus the attack vector is local. The impact could range from a kernel crash to potentially privilege escalation if the attacker can execute arbitrary code in the kernel context. Overall, the risk warrants prompt patching.