A flaw in the Linux kernel’s xfrm packet‑processing code causes the skb->prev pointer of a GSO segment list to remain pointing at a segment that has been stolen by asynchronous crypto. The stale pointer is later dereferenced when the list is re‑validated, resulting in a use‑after‑free that can corrupt kernel memory and compromise the integrity of the system. The core weakness is a classic kernel use‑after‑free defect, capable of leading to privilege escalation or denial of service. The description indicates that the attack could be triggered by sending crafted network packets that provoke the async crypto to steal a segment during transmission.

All Linux kernel builds that contain the vulnerable GSO segment handling logic but do not yet include the patch are affected. The bug was present in kernel sources before the commit that fixes the stale skb->prev issue, and the patch is the official remediation. Exact affected version ranges are not specified, but any kernel released prior to incorporation of the fix is subject to the risk.

The CVSS score is not listed, but the nature of the exploit—a kernel use‑after‑free—suggests high severity. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, indicating no documented widespread exploitation yet. However, an attacker that can send malformed packets to the kernel, potentially from a remote source, could trigger the flaw, making the attack vector likely remote via network traffic. The fix requires kernel patching; until it is applied the vulnerability remains exploitable.