A flaw in the Linux kernel’s skbuff_fclone_cache routine allows a hardened usercopy vulnerability when user space reads a socket error queue. When CONFIG_HARDENED_USERCOPY is enabled, the kernel copies the skb->cb field to userspace via sock_recv_errqueue() -> put_cmsg(). Because skbuff_fclone_cache lacks a proper whitelist, this triggers a usercopy hardening check failure, causing a BUG() and kernel panic. The result is loss of system availability and a potential crash of the affected process. The weakness maps to input validation and untrusted data handling, reflected in CWE‑476 and CWE‑489.

The issue affects Linux kernel releases that use the fclone cache and have CONFIG_HARDENED_USERCOPY enabled, including the 6.12 series and earlier 6.19 release candidates. Any distribution or customized kernel containing those components is potentially vulnerable if the patched code has not been applied.

The CVSS score is 5.5, indicating moderate severity, while the EPSS score is below 1%, reflecting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a userspace program that can manipulate TCP sockets to generate error queue entries and trigger the bug, which can be done locally or over a network if the system accepts crafted packets. An attacker who succeeds can force a kernel panic, temporarily or permanently disrupting service. The low EPSS suggests that widespread, automated attacks are unlikely, but targeted or zero‑day exploitation could still be feasible if an attacker gains sufficient interaction with the vulnerable socket stack.