A use-after-free vulnerability exists in the Linux kernel's net: psp subsystem due to improper handling of the Rx association during socket cloning. This flaw can lead to memory corruption when timewait sockets hold references to freed memory. The issue arises because the per-connection SPI and key association is inherited incorrectly by cloned sockets, causing reference count imbalances and eventual use-after-free errors.