A shift‑out‑of‑bounds error occurs in the Linux kernel’s xfrm selector matching logic when a selector with an unspecified address family (AF_UNSPEC) and an unusually large prefix length (e.g., 128) is matched against an IPv4 flow while the XFRM_STATE_AF_UNSPEC flag is set. The kernel function xfrm_selector_match does not verify that the selector’s family and prefix length are appropriate for the flow’s address family, causing the mismatch to trigger an out‑of‑bounds write. The description implies that such an overflow could corrupt kernel memory; this potential impact is inferred from the nature of the error but has not been claimed as a proven exploit. If exploited, the resulting memory corruption could permit local privilege escalation or arbitrary code execution.

All Linux kernel releases are potentially affected until the described patch is applied. The affected component is the xfrm selector matching logic that processes IPsec policy selectors in the kernel. No specific affected kernel versions are given, so all pre‑patch Linux kernels are considered vulnerable.

Based on the supplied metrics, the vulnerability carries a CVSS score of 7.8, indicating high severity for a kernel memory corruption that could provide an attacker with privilege escalation. The EPSS score is less than 1 %, pointing to a low chance of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely local and would require the attacker to gain kernel module insertion or other privileged write capabilities; therefore the overall risk is high in terms of potential impact but low in terms of current exploitation probability.