The Linux kernel’s xfrm subsystem suffers a use‑after‑free bug that arises during asynchronous packet resumption. When a packet’s socket buffer receives a new network device reference from a tunnel callback without first incrementing the device’s reference count, the subsequent resumption path decrements the counter on the wrong device. This mis‑management can corrupt device reference counts, causing a kernel crash or, in the worst case, executing arbitrary code at the kernel level. The flaw is a classic use‑after‑free coupled with a race condition, aligning with CWE‑825.

All Linux kernel releases that do not include the patch from commit 63a30015199912bd5055bead8001b1ae68a67cdb are considered vulnerable. The vulnerability exists wherever the xfrm framework is used, such as IPsec or virtual tunnel interfaces (VTI). Distribution‑specific kernel versions that have not incorporated the commit remain at risk, regardless of vendor.

The CVSS score of 9.8 places this flaw in the critical severity class. Its EPSS score of less than 1 % indicates a low but non‑zero probability of exploitation. The flaw is not yet listed in the CISA KEV catalog. Attackers would likely trigger the race by sending crafted packets to a vulnerable tunnel interface; the described behavior suggests that a single privileged kernel access or even remote code execution is possible once the race condition is triggered. While the low EPSS score suggests limited current exploitation, the critical score and kernel‑level impact warrant prompt remediation.