The Linux kernel hardcoded the default network namespace (&init_net) when publishing XFRM migration notifications. Consequently, an IPsec IKE daemon running in the default namespace receives migration events generated by any other network namespace, while an IKE daemon running in an isolated namespace never receives events about its own migration. This misrouting breaks IKEv2 MOBIKE address‑update handling, causing VPN tunnels to fail or remain out of sync. The flaw is a privileged kernel defect; it does not directly expose confidential data but it can lead to denial of service for IPsec VPN services deployed across multiple namespaces.

All installations of the Linux kernel that have not yet incorporated the upstream patch that removes the &init_net hardcoding are affected. The vulnerability applies to every distribution kernel prior to the included commit. Once the kernel includes the fix, the issue no longer exists regardless of distribution.

The CVSS score of 7.3 indicates high severity, while the EPSS score of less than 1% suggests exploitation is unlikely in the wild. The flaw resides in privileged kernel code and is not listed in CISA's KEV catalog. The primary risk is the potential disruption of VPN services in environments that use network namespaces and IPsec. No public exploits have been reported.