The flaw exists in the Linux kernel’s XFRM state handling. When a state object is removed more than once, the first deletion uses hlist_del_rcu() which leaves a poisoned pointer that marks the list as hashed. A second deletion then writes through this poisoned pointer, corrupting memory and creating a write use‑after‑free. This corruption can cause a later hlist traversal to follow a dangling pointer, leading to a read use‑after‑free and potential compromise of kernel memory. An attacker who can trigger repeated deletions of XFRM states could read or modify kernel data, eventually hijacking control flow and escalating privileges or executing arbitrary code.

All Linux kernel builds that have not yet applied commit 14acf9652e56, which changes the state_cache and state_cache_input list delete function to hlist_del_init_rcu(). This includes every distribution or custom kernel that remains on a kernel version where those lists use hlist_del_rcu() and does not yet incorporate the patch.

The CVSS score of 7 denotes high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require a local or privileged attacker capable of manipulating IPsec traffic or invoking kernel code that deletes state objects; remote exploitation through normal network traffic alone appears unlikely.