The flaw is a race condition (CWE‑362) that allows an attacker to trigger an XFRM_MSG_NEWSPDINFO request that queues a net‑namespace work item. If the namespace is torn down before the work executes, the callback dereferences freed memory, which can corrupt kernel data or lead to arbitrary code execution. The effect is a kernel memory corruption that could elevate privileges or cause a crash. This vulnerability is also characterized as a use‑after‑free (CWE‑364).

Vulnerable kernels are any Linux systems that contain the legacy XFRM implementation before the patch was applied. No specific version range is provided, so all kernels that lack the synchronize policy_hthresh.work change are at risk.

The CVSS score is 7.8, indicating high severity. The EPSS score of < 1% suggests a low likelihood of exploitation, and the vulnerability is not yet listed in CISA KEV. Attackers with the ability to send malicious XFRM messages or gain network-level access could trigger the race condition, potentially leading to privilege escalation or denial of service.