The Linux kernel’s xfrm subsystem stores a pointer to a networking namespace within the skb control block during transport‑mode IPsec packet handling. When this pointer is later used in a deferred reinjection callback it must remain valid. If the namespace has been torn down before the callback executes, the kernel dereferences a freed pointer, resulting in a use‑after‑free that can crash the kernel. The information does not indicate that arbitrary code execution or privilege escalation is guaranteed, so the primary impact is a potential kernel panic and system instability. The likely attack vector involves sending crafted IPsec packets that trigger the vulnerable reinjection path, a scenario that is inferred from the nature of the flaw.

Any Linux kernel build that contains the xfrm_trans_queue_net() logic and has not applied the newer net‑namespace reference fix is affected. The CVE does not list specific kernel releases; therefore all mainstream and custom builds containing the Xfrm transport‑mode reinjection code—especially those with IPsec support—are potentially vulnerable.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score of less than 1 % suggests that exploitation has not been widely observed, and the vulnerability is not included in CISA’s KEV catalog. Successful exploitation would most likely lead to a kernel crash rather than elevated privileges, given the lack of explicit evidence for code execution in the provided data. Exploitation would require an attacker to inject IPsec traffic that triggers the deferred reinjection logic, as inferred from the description.