A race condition in the Linux kernel’s espintcp implementation causes a use‑after‑free during socket close. When espintcp_close() frees an skb without holding the socket lock, the work queue can concurrently read that same skb through esp_output_tcp_finish(). This dangling pointer can be abused by an attacker who can control the timing of the close, enabling execution of arbitrary code in kernel mode which would elevate privileges to root. The issue arose from missing RCU synchronization and was addressed by adding synchronize_rcu() after resetting sk_prot.

Linux kernels that include the espintcp driver prior to the reference commit are affected. Any distribution using a kernel where espintcp is compiled or built as a module without this patch is vulnerable. The patch is included in later stable kernel releases; systems running versions earlier than that commit may still be at risk.

The flaw is a local kernel privilege escalation vulnerability that requires an adversary to trigger the closure of an espintcp socket and manipulate timing to exploit the race. While it demands local execution, a compromised or privileged service that creates espintcp sockets could serve as an entry point. No EPSS score or KEV listing is available, but the use‑after‑free in a critical driver indicates a high‑severity threat. If exploited, the attacker gains full kernel control, effectively compromising the entire system.