The vulnerability stems from a redundant use of alloc_compat() in the xfrm_state_netlink routine when handling compatibility ALLOCSPI requests. The kernel erroneously frees a socket buffer after the request handler returns while a compatibility receiver may still be copying data from it. This use‑after‑free can lead to a kernel crash or, depending on the execution context, arbitrary code execution. The flaw is categorized as CWE‑825 – a use‑after‑free condition.

All Linux kernel builds that expose the xfrm netlink interface are affected. This includes standard distribution kernels from major vendors such as Ubuntu, Debian, Red Hat Enterprise Linux, and Fedora, as well as custom‑built kernels that retain the xfrm subsystem. Version information is not specified in the advisory, so any kernel containing the unpatched code is at risk.

The EPSS score of < 1% indicates a low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to craft a malicious compat ALLOCSPI netlink message and send it to the system, which typically requires local privileges or the ability to inject netlink traffic. If an attacker can control that traffic, the resulting use‑after‑free could trigger a kernel panic or allow privilege escalation. With a CVSS score of 7.0, the risk remains medium overall, but the potential for kernel compromise warrants prompt remediation.