The Linux kernel had a reference‑counting bug in the xfrm policy migration function that created a memory leak when syzkaller exercised the policy allocation code. A double call to xfrm_pol_hold_rcu() left a policy reference count incremented without a matching decrement, causing an unfreed kernel memory object. This leak can accumulate over time, potentially exhausting system memory and leading to degraded performance or denial of service. The issue is a classic example of CWE‑911, which describes a programming error that causes resource exhaustion.

All Linux kernel builds that include the xfrm subsystem before the commit that removes the redundant reference increment are impacted. This includes almost every distribution running an unpatched kernel. The vulnerability exists in the kernel source tree, independent of vendor, and any system that uses the unpatched code will be affected.

The CVSS score of 5.5 indicates a moderate severity rating. The EPSS score of < 1 % and absence from the CISA KEV catalog suggest that public exploitation is uncommon. Based on the description, it is inferred that an attacker would need to influence kernel traffic that triggers policy migration, such as by sending crafted network packets that force an xfrm policy to be migrated. The likely attack vector is remote network traffic that initiates the xfrm policy path, although local privileged users could also trigger the condition. While the risk of exploitation is modest, repeated exploitation could allow an attacker to drain memory resources, resulting in denial of service.