In the Linux kernel, an asynchronous cryptographic completion path in the XFRM subsystem releases a device reference too early. The skb is returned to the network stack before the device reference count drops, and the skb's dev pointer is accessed inside NF_HOOK and its okfn callbacks. This timing window can race with device teardown, allowing the skb to reference a device that has already been freed, potentially leading to a use‑after‑free fault and kernel crash. The flaw is a classic race condition that can impact the confidentiality, integrity, and availability of the system by allowing a kernel panic or denial of service. Affected systems include all Linux kernel releases that matched the vulnerability. The CPE data indicates versions from 4.15 and all 7.0 release candidates (rc1 through rc7). Any running kernel that has not yet been patched will contain the buggy sequence where dev_put() is called immediately on async resume. The CVSS score of 7.8 indicates a medium‑to‑high severity. EPSS is below 1 %, suggesting that exploitation probability is low, and the vulnerability is currently not listed in CISA’s KEV catalog. Nonetheless, the presence of a race that can lead to a kernel crash means that once discovered, attackers may target vulnerable systems. The likely attack vector involves triggering the async crypto path (for example via IPsec or VPN traffic) while simultaneously tearing down or disrupting the network device. Because this requires interaction with the kernel network stack, the exploit would typically need sufficient privileges or a remote trigger that can generate the offending traffic. Mitigation and remediation steps are summarized below.

Linux kernels starting from 4.15 and all 7.0 release candidates. Systems running these kernels without the update are vulnerable. Vendor product name: Linux (kernel).

The CVSS score of 7.8 reflects a moderate to high risk of a kernel crash. The EPSS score of less than 1 % indicates a low probability of immediate exploitation, and the flaw is not yet listed in CISA’s KEV catalog. However, once an attacker discovers a trigger for the async crypto path, the race condition could be used to force a use‑after‑free, resulting in denial of service. The vulnerability can be exploited by sending crafted traffic that causes the async crypto completion, followed by operations that cause the underlying network device to be torn down. The requirement of a race between the crypto completion and device teardown makes the exploit non‑trivial, but the impact remains significant if successful.