The vulnerability arises in the Linux kernel's X.25 networking stack where a failure to allocate a socket buffer (skb) can trigger a double free. The kernel first frees the skb on allocation failure, then returns an error code that causes higher‑level functions to also free the same skb. This is a double‑free vulnerability (CWE-1341, CWE-415) that can corrupt kernel memory and lead to kernel crashes or potential privilege escalation. The likely attack vector is a crafted X.25 packet that forces a skb allocation failure, triggering the double‑free path.

Linux kernel users are affected. The fixed code resides in the source path net/x25/x25_in.c; any system running a kernel version prior to the patch that includes this X.25 driver is at risk. The precise versions are not listed, but all distributions shipping kernels without this fix are vulnerable when the X.25 protocol is enabled. The kernel version must be updated to the patched release that incorporates the double‑free fix.

The CVSS score is 9.8, indicating a critical severity. The EPSS score is <1%, implying a low probability of exploitation at present. Nevertheless, because the flaw permits kernel memory corruption, the potential impact remains high if an attacker can reach the vulnerable code. No published exploit is known at the time of this analysis, which lowers the immediate exploitation likelihood. The risk remains significant for environments that enable X.25 networking and run older kernels, as a local or remote attacker with packet injection capabilities could trigger the double‑free path and achieve privilege escalation or denial of service. The KEV catalog does not list this CVE, suggesting it has not been widely exploited yet.