A bug in the Linux kernel allows an automatically bound UDP socket to remain in the 4‑tuple hash table after the socket is disconnected. The lingering entry is not removed correctly, creating a garbage reference that may cause incorrect packet routing or kernel memory corruption. The description does not detail direct information leakage or privilege escalation, but the improper hash handling could lead to kernel instability.

The vulnerability affects all Linux kernel versions that contain the affected UDP socket handling code, as listed in the Common Platform Enumeration: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* No specific sub‑release or build is named; the issue applies to any kernel that has not been patched to remove the broken hash logic.

The CVSS score of 5.5 places the vulnerability in the moderate severity band, while the EPSS score of less than 1% indicates it is unlikely to be widely exploited. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Due to the kernel and socket nature of the flaw, the attack vector is inferred to be local, requiring the attacker to be able to manipulate UDP sockets on the affected host. Exploitation would potentially cause a kernel crash or reduced network reliability, impacting system availability.