The vulnerability lies in the Linux kernel’s xfrm framework, which manages IPsec state objects. When a new state is created, the framework caches a callbacks table (x->mode_cbs) while attempting to initialise the mode. If the mode initialisation fails before the mode data is published, the temporary module reference is dropped but the cached callbacks remain. A later garbage‑collection task then dereferences this stale pointer, leading to a kernel panic. The result is an immediate denial of service; the operating system crashes and must be rebooted.

All Linux systems running kernel versions that contain the buggy xfrm_state_gc_task logic are potentially affected. The CVE description does not list specific affected releases, and the CNA did not provide version bounds. In the absence of version data, the assumption is that any kernel build prior to the patch that introduced the fix is vulnerable.

The CVSS score is not provided, but the impact is severe (kernel crash). The EPSS score is missing; the issue is not listed in CISA’s KEV catalog, which suggests no known exploits. Nevertheless, the flaw can be triggered via a failed IPTFS setup, which can be achieved by an attacker with the ability to inject bad configuration or load a malicious module. Due to the local nature of the packet processing and module operations, the attack is likely limited to hosts that can access the vulnerable system or that run the affected module, but a compromised module could trigger the panic. The risk is high due to the catastrophic reliability impact, even if the exploitation probability is uncertain.