The vulnerability lies in the Linux kernel's handling of the XFRM security path during packet input processing. While xfrm_input records the current state, certain receive callbacks reset that reference before the function finishes dereferencing it. If secpath_reset drops the sole reference while the state is concurrently deleted, the function touches freed memory, leading to a Use-After-Free condition that can enable arbitrary kernel code execution or denial of service.

All Linux kernel releases that have not applied the patch which modifies secpath handling can be vulnerable. The vulnerable product is the Linux kernel offered by Linux distributions; no specific version range is visible, so any kernel built with the original logic may be affected.

The CVSS score of 7.8 indicates high severity. The EPSS score is under 1% and the vulnerability is not in the CISA KEV catalog, indicating limited public exploitation risk. An attacker able to send crafted network traffic that activates VTI or XFRM interfaces—such as cross‑namespace packets—may trigger the Use-After-Free, potentially achieving kernel privilege escalation or causing a reboot. Based on the description, it is inferred that network access is sufficient to exploit the flaw.