Linux Kernel EUVD-2026-27624

Exploitation requires: (1) local access to the system with CAP_NET_ADMIN capability or equivalent (typically root or unprivileged user with netlink socket capability); (2) xfrm transform states must be configured with non-zero if_id values (interface identifiers), which is NOT a default configuration and only present in deployments using interface-based IPsec routing or specialized VPN setups; (3) XFRM kernel subsystem must be compiled and enabled. Systems without IPsec xfrm configured, or with only if_id=0 (default) xfrm states, are not vulnerable. The attack is unauthenticated in the sense that local users without special privilege levels can still trigger it if if_id states exist, making the vulnerability more accessible than standard root-only netlink operations.

CVSS 5.5 (AV:L/AC:L/PR:L/UI:N) indicates local attack vector requiring low privilege with low complexity, but availability impact only (denial of service via panic, no code execution or information disclosure). EPSS score of 0.02% (5th percentile) contradicts the CVSS base score and suggests very limited exploitation likelihood despite accessibility. This discrepancy indicates the vulnerability requires specific xfrm state configuration with if_id set, which is not a default configuration in most deployments. The BUG_ON() assertion creates a 'use-after-free' style panic rather than a controlled error path, making this an availability-only DoS suitable for local administrators or unprivileged users with direct kernel access. Real-world risk is LOW for most deployments because xfrm states with if_id are typically configured only in specialized VPN/IPsec environments; however, targeted deployments using interface-based routing with IPsec are at higher risk. No active exploitation or POC is indicated in the provided data.

A local unprivileged user or administrator on a Linux system with IPsec xfrm states configured with interface IDs crafts a netlink XFRM_MSG_GETAE request targeting one of these states. The kernel allocates insufficient buffer space, build_aevent() exceeds bounds when appending XFRMA_IF_ID, and the BUG_ON assertion triggers, causing immediate kernel panic and system crash without authentication or user interaction required beyond sending the netlink message.