The vulnerability occurs when the xfrm_user_policy() function clears a socket's destination cache with a non‑atomic reset, causing a race with the UDP transmit fast path. If an unprivileged user changes a socket policy while a send is in progress, both sides may release the same destination object twice, resulting in a double‑free and a use‑after‑free detected by KASAN. A kernel object freed twice can be corrupted, leading to a kernel crash or providing an attacker a foothold to execute arbitrary code at the privileged level. The impact is full kernel compromise or denial of service that could affect all processes on the affected host.

All vulnerable Linux kernel releases prior to the patch that includes the atomic sk_dst_reset() fix. The exact affected kernel versions are not listed in the advisory, but any system running a kernel without this update can be impacted.

An attacker who can create an unprivileged socket in a user and network namespace can induce the race and trigger the double‑free via the setsockopt system call. The exploit does not require elevated privileges, though it targets the kernel. The CVSS score of 7.8 indicates a high severity. The EPSS score of 0.00145 (less than 1%) indicates a very low but nonzero likelihood of exploitation in the wild, while the absence from the KEV catalog suggests no widespread active exploitation has been observed. The critical nature of a kernel use‑after‑free warrants a high risk assessment. The application of the atomic reset reduces the problem to a safe, single release path, preventing the vulnerability.