The flaw allows an attacker to trigger an XFRM_MSG_NEWSPDINFO request that queues a net‑namespace work item. If the namespace is torn down before the work executes, the callback dereferences freed memory, which can corrupt kernel data or lead to arbitrary code execution. The effect is a kernel memory corruption that could elevate privileges or cause a crash.

Vulnerable kernels are any Linux systems that contain the legacy XFRM implementation before the patch was applied. No specific version range is provided, so all kernels that lack the synchronize policy_hthresh.work change are at risk.

Although no CVSS score is supplied, the existence of a use‑after‑free in the core networking stack indicates high severity. EPSS is not available and the issue is not yet listed in CISA KEV, but the underlying race condition could be exploited remotely if an attacker can invoke malformed XFRM messages. Attackers with network-level access or the ability to send XFRM packets could trigger the fault, leading to privilege escalation or denial of service.