In the Linux kernel, a race condition occurs when an incoming network state is inserted into the xfrm cache; the code validates the state before acquiring the global lock, allowing another thread to delete or invalidate it afterward. This flaw allows a dead or stale state to be cached, corrupting kernel data structures and potentially causing a crash or unpredictable behavior. The vulnerability is a classic race condition, identified as CWE‑367.

All Linux kernel builds that lack the fix commit 041859f and its integrated successors are vulnerable. The advisory does not specify exact versions, so any kernel version prior to applying this patch may be affected.

Based on the description, it is inferred that triggering the race requires local kernel‑level privilege or privileged network traffic. The CVSS score of 9.8 indicates a high‑severity kernel race condition. The EPSS score of < 1% suggests a low likelihood of exploitation in the near term, and the vulnerability is not listed in CISA KEV. A successful exploitation could lead to kernel instability, denial of service, or possible escalation of privileges if an attacker can manipulate cached states.