The Linux kernel had a reference‑counting bug in the xfrm policy migration function that caused a memory leak when syzkaller exercised the policy allocation path. The double call to xfrm_pol_hold_rcu() left a reference held, resulting in an unreferenced object that never freed. This leak can accumulate over time, potentially exhausting memory and degrading system stability. The fix removes the redundant call, restoring correct reference counting.

All Linux kernel builds that include the xfrm subsystem prior to the commit that removes the redundant reference increment are affected. The issue is present in the kernel source tree regardless of distribution; any vendor using an unchanged kernel may be impacted.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating limited public exploitation data. Because the leak only manifests during specific policy migration scenarios, an attacker would need influence over kernel traffic or the ability to trigger these conditions, making the likelihood of exploitation modest. However, the potential for memory exhaustion could lead to denial of service if the leak is sufficiently large or if the system is under heavy load.