A use‑after‑free occurs in the __input_process_payload() function within the XFRM/iptfs subsystem when the first socket buffer is stored and later accessed without proper locking after the processing loop exits. If a concurrent reassembly or timer frees the buffer, subsequent operations on that freed memory trigger a kernel‑space use‑after‑free. Based on the description, it is inferred that this flaw may lead to kernel crashes or possibly arbitrary code execution, effectively providing an attacker with kernel‑level privileges or denial of service.

All Linux kernel builds that include the vulnerable XFRM/iptfs reassembly code are affected. The specific fix is implemented in commit 8d9a79fbf5172d9c4c0146057af2360913265a11; any kernel version prior to that commit is vulnerable, while kernels containing that commit or later are considered patched.

The vulnerability is a classic use‑after‑free (CWE‑416). Although no CVSS score or EPSS information is available, the nature of the flaw suggests the possibility that an attacker could trigger the reassembly path by sending crafted packet fragments. Based on the description, it is inferred that exploitation could result in kernel crashes or kernel‑level code execution, effectively providing denial of service or escalation of privileges. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that the attack vector would likely involve network traffic targeting the reassembly logic, and because exploitation requires only such network access, the risk is considered potentially high, yet the lack of publicly available exploit details or score metrics means security teams should treat it as a serious kernel flaw worth addressing promptly.