The vulnerability lies in the Linux kernel’s xfrm policy hash rebuild routine. An inverted guard causes the routine to pre‑allocate bins for the wrong set of policies, leading to a failure path that warns only and leaves a poisoned list node. When the next rebuild deletes that node, a null pointer dereference occurs, producing a kernel panic via a general protection fault. This crash immediately stops the operating system, creating a denial‑of‑service liability for any system running the affected kernel.

Linux kernel versions that contain the flawed xfrm_hash_rebuild implementation are impacted. No specific release scope is given, so all kernels prior to the patch referenced in the advisory may be vulnerable. The included CPE identifies the generic Linux Kernel product.

The bug can be triggered by actions that cause the xfrm policy table to be rebuilt under memory pressure; it is a local condition that an attacker with access to the host can potentially manipulate via network policy changes or module loading. Exploitation would result in a kernel crash, but no evidence of remote code execution is present. EPSS data is not available, and the CVE is not listed in CISA’s KEV catalog. The severity of the crash suggests a high‑impact vulnerability, but without a documented CVSS score it should be treated as a critical denial‑of‑service risk.