The Linux kernel contains a use‑after‑free flaw in the __xfrm_state_delete routine, which unhashes IPsec state structures. When a second delete occurs on the same object, deleted hlist entries still reference memory that has been reclaimed, allowing a write through a poisoned pointer. This memory corruption can crash the kernel and, in some circumstances, provide a vector for privilege escalation. The flaw is identified by KASAN traces of slab‑use‑after‑free on the byseq/byspi hash chains and histograms of OOB writes.

Linux kernels that include the unpatched IPsec cleanup code are affected. The vulnerability was reproduced on Linux 6.12.47 and is reachable via the master and ipsec branches. Any kernel version prior to the commit that introduced defensive hlist_del_init_rcu and hlist_unhashed checks is potentially vulnerable.

No CVSS score is provided and EPSS data is unavailable, but the flaw can trigger a kernel crash or escalation. The attack may be leveraged through network traffic that forces IPsec state cleanup or through local operations that invoke xfrm_state_delete. Since the exploit path involves kernel memory, a successful exploitation could compromise the host or compromise user processes. The vulnerability is not currently listed in CISA KEV, indicating no confirmed exploits in the wild yet, but the impact warrants immediate attention.