This race condition in the Linux kernel nfp allows the secure IPsec RX state lookup to be released while the XArray lock is still held, enabling an attacker to trigger a use‑after‑free scenario. The flaw occurs when the driver drops the XArray lock before referencing the xfrm_state, allowing the delete path to erase the entry and release the last state reference. Subsequent RX processing can then increment a zero reference count, potentially leading to memory corruption or arbitrary code execution.

All Linux kernels that include the nfp network frontplane driver before the commit that adds the lock fine‑grained reference acquisition are affected. No specific version strings are listed, so any distribution using a kernel that contains the vulnerable nfp implementation is at risk.

The CVSS score is 5.9, and the EPSS score is < 1%, indicating limited publicly available data on exploitation probability. The bug requires a concurrent race between network traffic and internal kernel teardown, which is technically possible but non‑deterministic. While no public exploit is noted and the vulnerability is not listed in the CISA KEV catalog, the potential for memory corruption and the lack of safeguards suggests a moderate to high risk for malicious actors with control over IPsec traffic.