The Linux kernel contains a use‑after‑free vulnerability in the __xfrm_state_delete routine, which removes IPsec state structures from hash lists. When a second deletion occurs on the same object, references to freed memory are still used, leading to a write through a poisoned pointer. The flaw is identified by KASAN trace messages indicating slab‑use‑after‑free on the byseq/byspi hash chains and by observed out‑of‑bounds writes. This memory corruption can cause the kernel to crash and potentially destabilize system operations.

Linux kernel versions that include the vulnerable IPsec cleanup code are affected, notably Linux 6.12.47 and all earlier releases before the commit that added defensive hlist_del_init_rcu and hlist_unhashed checks. The code path is also reachable via the current master and ipsec branches, so any kernel derived from those code trees without the patch is potentially vulnerable.

The CVSS score is 7.8, the EPSS score is < 1%, and this vulnerability is not listed in CISA KEV. The likely attack vector is through network traffic that forces IPsec state cleanup or by executing local code that calls __xfrm_state_delete, which could corrupt kernel memory and lead to a system crash. No confirmed exploits have been reported, but the impact warrants timely remediation.