In the Linux kernel, the xfrm packet‑processing code leaves a stale skb->prev pointer when an asynchronous crypto operation steals a GSO segment. This stale pointer is later dereferenced, resulting in a use‑after‑free that can corrupt kernel memory and potentially allow privilege escalation or denial of service. The weakness is a classic kernel use‑after‑free defect (CWE‑825). The CVE description explicitly states that the bug leads to memory corruption.

All Linux kernel builds that contain the vulnerable GSO segment handling logic but do not yet include the patch are affected. The bug was present in kernel sources before the commit that fixes the stale skb->prev issue, and the patch is the official remediation. Exact affected version ranges are not specified, so any kernel released prior to incorporation of the fix is at risk. In particular, any distribution that ships a kernel older than the one containing the commit referenced in the advisory is vulnerable.

The CVSS score of 9.8 indicates critical severity. The EPSS score is below 1%, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote via network traffic that triggers the asynchronous crypto operation. An attacker could craft malformed packets that are transmitted over an interface supporting GSO, forcing the kernel to invoke async crypto and potentially causing the use‑after‑free. Because the vulnerable code operates in the kernel network stack, exploitation could allow escalation of privileges or a denial‑of‑service if successful. The low EPSS suggests that widespread or automated exploitation has not been observed yet, but the presence of a remote trigger pathway warrants vigilant patching.