The Linux kernel's xfrm input code for transport-mode reinjection previously stored a struct net pointer in skb->cb for later use in xfrm_trans_reinject(). This pointer needed to remain valid until the deferred callback executed. The vulnerability stemmed from improper lifetime management of the network namespace pointer, risking use of an invalid pointer if the namespace was torn down before the callback. The fix introduced taking a netns reference via maybe_get_net() when queueing deferred reinjection work and dropping it after the callback finishes, ensuring the pointer remains valid and preventing potential kernel memory corruption or crashes related to network namespace lifecycle mismanagement.

Improper handling of the network namespace pointer could lead to use-after-free or invalid memory access within the kernel during deferred transport-mode reinjection processing. This could cause kernel instability or crashes. No known exploits are reported in the wild. The vulnerability affects the Linux kernel's xfrm subsystem but no specific affected versions are stated.

A fix has been implemented in the Linux kernel to properly manage the network namespace reference during deferred transport reinjection. Users should apply the official kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing list advisories for the current remediation status and updated kernel versions containing the fix.