A flaw in the Linux kernel’s xfrm IPsec implementation results in a reference‑count leak for struct xfrm_state. The missing xfrm_dev_unregister logic prevents the kernel from releasing device references when a network device is unregistered, allowing the leak to grow unchecked and potentially exhausting kernel memory, which can destabilise or crash the system.

All Linux kernel releases that contain the xfrm IPsec code and do not incorporate the fix from commit 03891f820c21 or later are affected. This includes standard distribution kernels and custom builds that have not applied the relevant upstream patch.

The CVSS score of 5.5 places this vulnerability in the moderate severity range. Based on the description, it is inferred that exploitation requires local administrative privileges to add and remove xfrm states with hardware offloading enabled via root netlink commands or the ip command. The likely attack vector is local, involving privileged netlink or ip operations. The EPSS score of <1% indicates a very low probability of exploitation. Because the exploit path depends on privileged operations and the bug is not remotely triggerable, the overall risk is considered moderate; however, it can lead to a complete denial of service if the leak accumulates indefinitely. The vulnerability is not listed in the CISA KEV catalog, indicating no current widespread exploitation.