The Linux kernel contains a use‑after‑free vulnerability in the __xfrm_state_delete routine, which removes IPsec state structures from hash lists. When a second deletion occurs on the same object, references to freed memory are still used, leading to a write through a poisoned pointer. This flaw corresponds to CWE‑416 (Use After Free) and CWE‑763 (Hash Table State Inconsistency). KASAN trace messages indicate slab‑use‑after‑free on the byseq/byspi hash chains and observed out‑of‑bounds writes. The memory corruption can cause the kernel to crash and potentially destabilize system operations.

Linux kernel versions that contain the vulnerable __xfrm_state_delete implementation are affected; the defect was observed in 6.12.47, but the same code path exists in the current master and ipsec branches, so any kernel derived from those without the patch is potentially vulnerable.

The CVSS score is 7.8, the EPSS score is < 1%, and this vulnerability is not listed in CISA KEV. The likely attack vector is through network traffic that forces IPsec state cleanup or by executing local code that calls __xfrm_state_delete, which could corrupt kernel memory and lead to a system crash. No confirmed exploits have been reported, but the impact warrants timely remediation.