The Linux kernel's xfrm subsystem previously called synchronize_rcu() in the pernet_operations .exit handler during network namespace cleanup, violating documented guidelines that prohibit blocking RCU primitives in .exit handlers. This caused cleanup_net() to perform O(N) RCU grace periods serially for N namespaces, leading to excessive blocking, accumulation of struct net objects in the cleanup queue, and high memory usage (over 130 GB Percpu memory on large hosts). The fix moves the policy flush and dependent workqueue drains to a new .pre_exit handler, while xfrm_policy_fini() runs in .exit after an expedited synchronize_rcu() guaranteed between the two phases. This change reduces RCU grace periods to O(1) per batch, preventing resource exhaustion and improving cleanup performance.

The vulnerability can cause significant resource exhaustion and system instability during network namespace cleanup under workloads that create namespaces rapidly (e.g., ~13 per second). This manifests as excessive blocking in synchronize_rcu(), accumulation of net namespace structures in cleanup queues, large memory consumption, and potential out-of-memory conditions. There is no indication of direct security compromise or code execution, but system availability and stability can be severely impacted.

A fix has been implemented in the Linux kernel to move the RCU synchronization from the .exit handler to the .pre_exit handler in the xfrm subsystem, improving cleanup efficiency and preventing resource exhaustion. Users should update to a Linux kernel version that includes this fix once available. Patch status is not yet confirmed; check the vendor advisory or Linux kernel release notes for the specific fixed version and apply updates accordingly.