A double cleanup bug in the TLS encryption path of the Linux kernel corrupts a reference counter and restores scatter‑list entries twice. This corruption allows the asynchronous encryption callback to access a TLS record that has already been freed, resulting in a use‑after‑free that can crash the kernel or lead to a denial‑of‑service. The vulnerability is a classic resource‑management error classified as CWE‑416 and CWE‑763.

All Linux kernel installations running a version prior to the inclusion of the fix in commit 5d70eb25b41e9b010828cd12818b06a0c3b04412 are affected. The vulnerability applies to every Linux distribution that ships with the kernel source containing the buggy code path, because the affected code is part of the core operating‑system kernel.

The CVSS score of 9.8 marks this flaw as critical, and although the EPSS score is below 1%, suggesting a currently low exploitation probability, the vulnerability remains highly severe. It is not listed in the CISA KEV catalog. The likely attack vector is an attacker able to inject or manipulate TLS traffic toward a vulnerable system; a malicious payload sent over the network could trigger the double cleanup and cause a kernel crash. Because the flaw is in kernel space, it would require the attacker to control the data sent through TLS, which could be achieved from outside the host via crafted network packets.