The flaw resides in the Linux kernel’s NAT keepalive logic, where the nat_keepalive_work() routine walks the state table while holding the xfrm_state_lock and then attempts to acquire individual state locks (x->lock). The delete path, however, locks these resources in the reverse order. This reverse ordering (AB‑BA) can lead to a classic deadlock, causing the keepalive worker to stall and potentially disrupting network packet handling. The underlying weakness is a deadlock resulting from improper lock ordering, classified as CWE-666.

Any Linux kernel build that still contains the original nat_keepalive_work() and xfrm_state_walk() implementations without the recent commit is vulnerable. The vendor coverage is Linux: Linux, meaning all kernel source releases that include this code path are at risk until the patch is applied.

No CVSS score is listed, and the EPSS score is not available, which suggests either a lack of published data or an extremely low exploitation probability. The vulnerability is not in the CISA KEV catalog. The deadlock can only be triggered under conditions where a NAT keepalive worker and a state deletion race, typically requiring local or privileged execution, though a malformed packet stream might accelerate the race. In practice, the impact is limited to denial of service for affected networking services, not direct lateral movement or data leakage.