The vulnerability in the Linux kernel's xfrm subsystem involves the iptfs_clone_state() function, which clones IPTFS mode data using kmemdup(). This cloning copies runtime objects such as sk_buff_head, hrtimers, spinlocks, and in-flight reassembly state that must not be shared between the original and cloned SAs. If the migration of state fails after cloning but before reinitialization, the cloned state can be destroyed with invalid references, causing use-after-free and double-free conditions in iptfs_destroy_state() and skb release paths. The fix involves reinitializing the clone's runtime state before it is published and adjusting module reference handling to prevent premature destruction.

Exploitation of this vulnerability can lead to use-after-free and double-free conditions in kernel memory management related to IPTFS state cloning. This can cause kernel crashes or potentially allow an attacker to execute arbitrary code or escalate privileges by corrupting kernel memory. However, no known exploits are reported in the wild at this time.

A fix for this vulnerability has been implemented in the Linux kernel by reinitializing the cloned runtime state before it is published and correcting module reference handling. Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed — check the vendor advisory or Linux kernel mailing lists for current remediation guidance.