The vulnerability arises because the WireGuard handshake processing in the Linux kernel does not correctly guard against concurrent processing of the same response. Two kernel threads can complete the cryptographic calculations and copy the handshake state simultaneously, causing the handshake structure to be overwritten with an earlier state while later threads derive a session from that intermediate state. An attacker that can send duplicate or carefully crafted handshake responses may be able to induce this race, resulting in the kernel creating two WireGuard sessions that share identical or inconsistent cryptographic material. This could lead to session persistence issues, misconfiguration, or, in a worst case scenario, exposure of encrypted traffic if an incorrect key is used.

All Linux distributions that ship a kernel with the vulnerable WireGuard implementation are affected. The specific kernel versions are not listed in this CVE, so any kernel before the commit that introduced the fix (see the provided git references) is potentially vulnerable on both server and client endpoints that rely on kernel‑space WireGuard.

The CVSS and EPSS scores are not provided, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the issue is a race condition that could be triggered by a network attacker sending duplicate handshake replies. The exploitation complexity appears high and the likelihood of successful exploitation low; no public exploits are known. Nevertheless, because the bug involves the fundamental cryptographic state of a VPN tunnel, it is prudent to treat it as a moderate risk until a patch is applied.