The vulnerability is a race condition in the Linux kernel’s xfrm state management that can lead to a use‑after‑free of an xfrm_state object. When a device state flush occurs, the code releases its lock before invoking a driver callback that may sleep, allowing the garbage collector to free the same state concurrently. This double free corrupts kernel memory and can crash the system or provide a foothold for arbitrary code execution. The flaw is a memory‑management weakness catalogued as CWE‑416.

Any instance of the Linux kernel that implements the xfrm state device cleanup routine is susceptible. The flaw exists in all kernel builds that contain the xfrm code before the upstream patch that serializes destruction is applied. This includes all mainstream distributions and custom kernels that have not yet updated to a version containing the fix.

The EPSS score is reported as < 1 %, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 7.0 classifies it as high severity. Despite this, a use‑after‑free in kernel code is a high‑risk flaw that can lead to denial of service or remote code execution if an attacker can trigger the race. The attack vector likely requires local privileges or manipulation of networking state, but no public exploits have been observed.