A slab‑use‑after‑free bug in the Linux kernel’s TIPC decryption path enables a read of freed memory in tipc_aead_decrypt_done. If triggered, this flaw can expose arbitrary kernel data and may allow an attacker to execute higher‑privileged code, as the vulnerable read occurs after the per‑netns cryptographic structure has been released.

All Linux kernel systems that ship the unpatched TIPC implementation are affected. The CVE description indicates the bug resides in the core kernel, so any distribution that uses the default TIPC module without applying the upstream fix will be vulnerable. This conclusion is inferred, as the specific kernel versions are not listed in the data.

With a CVSS score of 8.8, the vulnerability carries high impact, yet the EPSS score of less than 1 % and absence from the CISA KEV catalog indicate a low probability of widespread exploitation at present. Exploitation requires delivering crafted encrypted TIPC traffic to a target running TIPC with crypto offload enabled (e.g., via cryptd), causing the asynchronous decrypt path to execute after the bearer’s network namespace has been torn down. No public proof‑of‑concept exploits are known, but the use‑after‑free could ultimately enable remote code execution or privilege escalation if successfully abused.