An early‑exit handler in the Linux kernel’s xfrm policy cleanup synchronizes with RCU while holding the policy_bydst hash tables. The synchronizing call is executed in a per‑namespace .exit method, causing cleanup of every namespace to wait for a full RCU grace period sequentially. When many network namespaces are created at high frequency, each cleanup stalls for a long time, allowing memory to accumulate and eventually trigger out‑of‑memory conditions. This is a classic example of a locking issue that falls under CWE‑821, where synchronization primitives are used incorrectly during cleanup. The impact is therefore the consumption of system memory and potential denial‑of‑service via OOM, not immediate code execution.

The flaw exists in the Linux kernel, observed in release 6.18. Any Linux distribution using this kernel version or earlier versions that have not applied the RCU‑pre_exit change is vulnerable. The primary affected component is the xfrm policy cleanup routine that operates during namespace teardown. No specific vendor or product patch level list is supplied, but all kernels before the commit that moves the logic to .pre_exit are impacted.

The EPSS score is reported as less than 1 %, indicating a very low probability of widespread exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require an actor with sufficient privileges to create many network namespaces on the host or a workload that continuously spins namespaces, making this a local or privileged‑class risk. The operational impact can be severe on large systems (hundreds of CPUs) where a long tail of RCU grace periods can accumulate to hundreds of gigabytes of memory, leading to kernel OOM survivors. Because the attack mechanism is tied to namespace allocation rate, timely patching mitigates the risk effectively.