A use-after-free flaw in the Linux kernel xfrm iptfs subsystem allows local attackers with low privileges to achieve full system compromise.

This issue is a use-after-free and double-free vulnerability caused by improper handling of runtime state cloning in the iptfs_clone_state function within the xfrm subsystem, requiring low local privileges and no user interaction.

A successful exploit of this vulnerability can lead to complete system compromise, including unauthorized data access, modification of critical system files, and denial of service through kernel panics. With a CVSS score of 7.8, this high-severity vulnerability poses a significant risk to organizational assets residing on vulnerable hosts by enabling local privilege escalation or arbitrary code execution within the kernel context.

Immediate Action: Update the Linux kernel to version 6.18.35, 7.0.12, or later where the iptfs runtime state cloning issue is fully resolved.

Proactive Monitoring: Monitor system logs for kernel panics, segment faults, or unexpected reboots that may indicate exploitation attempts targeting kernel memory management.

Compensating Controls: Restrict local shell access and implement strict principle of least privilege policies to minimize the number of users capable of executing local commands on vulnerable systems.

Public Exploit Available: No

Organizations running affected versions of the Linux kernel must prioritize patching due to the high severity and potential for complete system compromise. Apply the official kernel updates immediately and ensure that all local user permissions are strictly audited to reduce the attack surface.