The flaw lies in the Linux kernel’s IPsec Transformation Services (IPTFS) routine that clones security association state. When iptfs_clone_state() duplicates runtime data with kmemdup(), the clone may retain references to the original packet queue, timers, and locks. If the subsequent migration fails before these fields are reinitialized, the original state can be garbage‑collected, causing the cloned structures to be freed. This triggers use-after-free and double-free errors when packets in the original IPTFS queue are processed, potentially leading to kernel memory corruption, crashes, or privilege escalation for an attacker controlling the migration path. The weakness is a type of unsafe memory management identified as CWE‑1341.

All Linux kernel builds (any architecture) are affected. The advisory lists the committed patch in recent kernel releases; administrators should verify whether their kernel version includes the commit that resets runtime state before publishing the clone.

With a CVSS score of 7.8, this is a high‑severity vulnerability, but the EPSS score is below 1% and the issue is not in CISA’s KEV catalog, indicating limited current exploitation. An attacker would need to trigger the specific kernel state migration failure, generally requiring local kernel access or the ability to influence IPsec traffic. If successful, the flaw can crash the system or allow privilege escalation.