A critical double-free vulnerability in the Linux kernel xfrm subsystem poses a significant risk of system instability or potential code execution.

The xfrm_dev_direct_output function incorrectly frees a socket buffer (skb) when the local_out function indicates it has already been consumed or transferred, resulting in a double-free condition. This flaw is reachable by an unauthenticated attacker capable of triggering specific network traffic paths through the kernel.

The vulnerability is rated as critical with a CVSS score of 9.8, reflecting the potential for complete system compromise. A successful exploit could lead to kernel panic, denial of service, or arbitrary code execution, resulting in significant operational downtime and the potential exfiltration of sensitive data residing in kernel memory.

Immediate Action: Update the Linux kernel to version 6.6.157, 6.12.110, 6.18.52, or 7.2.6 immediately to incorporate the upstream fix.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected system reboots that may indicate memory corruption events related to network stack processing.

Compensating Controls: While no direct WAF mitigation exists for internal kernel memory management, restricting network access to the host and employing kernel hardening features like Control Flow Integrity (CFI) can help limit the impact of memory corruption flaws.

Public Exploit Available: Unknown.

Given the critical severity of this kernel memory vulnerability, organizations should prioritize patching affected Linux distributions as part of their next maintenance cycle. System administrators must verify their kernel versions and apply the provided security updates to prevent potential system-wide compromise.