A race condition exists in the Linux kernel’s SMC module where the listening socket’s user data can be cleared while another context reads it, leading to a NULL pointer dereference or use‑after‑free. The vulnerability can trigger during the TCP three‑way handshake, potentially caused by specially crafted SYN packets addressed to a listening SMC socket. The result is a kernel panic that brings the affected host down, which is a classic denial‑of‑service outcome and may be exploitable for escalation if an attacker can influence kernel memory layout through the crash.

The flaw affects all Linux kernel builds that contain the unpatched smc_tcp_syn_recv_sock implementation. No specific kernel release range is identified in the advisory, but the commit notes and patch references span recent stable branches, so any distribution running a kernel before the change (including common server and embedded versions) is potentially vulnerable.

The CVSS score of 7.0 reflects a moderate severity; the EPSS score indicates this issue is not widely observed (<1%). It is not presently listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation. Attackers would need to send network traffic that reaches the vulnerable SMC socket; local privilege is not required, but the attack requires that the target machine still runs a listening SMC socket. Because the kernel is the target, exploitation generally requires a trusted environment to maintain the necessary context for the race, making the risk moderate but the likelihood low under normal conditions.