The vulnerability occurs when the xfrm_user_policy() function clears a socket's destination cache with a non‑atomic reset, causing a race with the UDP transmit fast path. If an unprivileged user changes a socket policy while a send is in progress, both sides may release the same destination object twice, resulting in a double‑free and a use‑after‑free detected by KASAN. A kernel object freed twice can be corrupted, leading to a kernel crash or providing an attacker a foothold to execute arbitrary code at the privileged level. The impact is full kernel compromise or denial of service that could affect all processes on the affected host.

All vulnerable Linux kernel releases prior to the patch that includes the atomic sk_dst_reset() fix. The exact affected kernel versions are not listed in the advisory, but any system running a kernel without this update can be impacted.

An attacker who can create an unprivileged socket in a user and network namespace can induce the race and trigger the double‑free via the setsockopt system call. The exploit does not require elevated privileges, though it targets the kernel. While no EPSS score is available, the lack of a KEV listing suggests a lower exploitation probability in the wild, yet the critical nature of a kernel use‑after‑free warrants a high risk assessment. The application of the atomic reset reduces the problem to a safe, single release path, preventing the vulnerability.