The Linux kernel’s xfrm framework can cause a kernel crash when a new IPsec state fails to initialize fully. During mode setup, the framework caches a callbacks table and drops the temporary module reference before mode data is published. The garbage‑collection task later dereferences this stale pointer, leading to a fatal exception. This flaw is a form of use‑after‑free or pointer misuse, identified as CWE‑825.

All Linux kernel builds that include the xfrm framework and the IPTFS IPsec module prior to the recent patch are potentially vulnerable. The CNA does not list specific version ranges, so any kernel revision before the commit that fixed the issue may be affected. Systems that load the xfrm_iptfs module for IPsec tunnels, or rebuild custom kernels with this module, are at risk.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The issue is not currently listed in CISA’s KEV catalog. Exploitation would typically require the ability to force a failed IPTFS state setup, which could be achieved by sending malformed IPsec packets or by compromising the module. Successful exploitation results in an unprivileged kernel crash, causing denial of service that requires a reboot to recover.