In the Linux kernel’s SMC module, a race condition exists when the listening socket’s user data can be cleared while another context reads it. This can result in a NULL pointer dereference or a use‑after‑free, which unconditionally triggers a kernel panic during the TCP three‑way handshake path. The crash brings the affected host down, effectively causing a denial‑of‑service. The vulnerability is a kernel‑level severity flaw that does not directly grant attacker privileges but can be leveraged to destabilize the system.

The issue applies to all Linux kernel builds that include the unpatched implementation of smc_tcp_syn_recv_sock(). No specific kernel release range is listed in the advisory; the patch references encompass recent stable branches, implying that any distribution running a kernel prior to the change – including common server and embedded variants – is potentially vulnerable.

The CVSS score of 9.8 indicates a high severity. The EPSS score of <1 % suggests the vulnerability is not widely observed, and it is not yet listed in CISA KEV, implying no confirmed widespread exploitation. The likely attack vector is network traffic that reaches the vulnerable SMC listening socket – for example, specially crafted SYN packets that invoke the problematic path. This requires only external network access to the host; local privileges are not required, but the target must have a listening SMC socket. Because the flaw is triggered by a race, the threat is high but the exploitation likelihood under normal conditions is considered low.