Technical impact
The vulnerability arises when the Linux kernel finalizes an XFRM network namespace by freeing the policy_bydst hash tables immediately after flushing policy work items, without waiting for concurrent RCU readers to exit their read‑side critical sections. Because these tables are published via rcu_assign_pointer and accessed through rcu_dereference_check, the premature release can trigger a use‑after‑free scenario. An attacker could potentially exploit this race to crash the kernel or manipulate privileged data, leading to denial of service or escalation of privileges within the affected system.
Affected Systems
The flaw is present in all versions of the Linux kernel that have not applied the patch that adds a synchronize_rcu() call before freeing the policy hash tables. No specific version range is listed; affected releases include any kernel built before the commit referenced in the advisory (e.g., 069daad4f2ae9c5c108131995529d5f02392c446).
Risk and Exploitability
The CVSS score is 7.8, indicating a high severity. The EPSS score is less than 1%, reflecting a very low likelihood of exploitation. The issue is not currently listed in CISA KEV, so no widespread exploitation is known. The exploit requires the ability to trigger a network‑namespace teardown while other contexts retain RCU references to the policy tables, which may limit the attack surface. Nevertheless, the potential for a kernel crash or privilege elevation warrants prompt action if the affected kernel version is in use.
Ubuntu USN