The vulnerability arises from a race condition in the Linux kernel's xfrm security module. The routine that inserts an incoming state into the cache performs a validity check before acquiring the global lock, which allows another thread to delete or invalidate the state after the check but before the lock is taken. The race can lead to a dead or stale state being cached, corrupting kernel data structures and potentially causing a crash or unpredictable behavior. This is a classic race condition flaw (CWE‑362) that threatens kernel integrity.

All Linux kernel releases that do not contain the fix commit (041859f and its merged successors) are affected. The advisory does not list specific version ranges, so any kernel version prior to the application of this patch is potentially vulnerable.

Because the CVSS score is not disclosed and no EPSS value is available, exploitation data is limited. The flaw is a local kernel race, meaning that kernel‑level privileges are required to trigger it. The vulnerability is not listed in the CISA KEV catalog and there are no publicly known exploits, implying a low probability of active exploitation. Nonetheless, a successful exploitation could lead to kernel instability or denial of service.