A use‑after‑free condition exists in the Linux kernel’s sockmap implementation within the sk_psock_verdict_data_ready() function. The flaw permits the kernel to read the sk->sk_socket of a socket that has already been freed, leading to arbitrary memory corruption in the kernel space. An attacker who can orchestrate the timing of AF_UNIX socket operations may trigger this defect, causing a system crash or potentially allowing execution of malicious code within the kernel context.

All Linux kernel releases that have not incorporated the approach detailed in commit 18861f87a043e78b1f901cae4237e755ed7ef095 are affected. includes every pre‑patch kernel version, such as the 6.x series and the 7.0 release candidates 7.0‑rc1 through 7.0‑rc6, as well as any distribution kernels derived from those sources without the patch. Users of kernels that contain the updated sk_psock_verdict_data_ready() logic are not vulnerable.

The CVSS score of 7.8 indicates a high impact when the flaw is exercised. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at present, yet the defect remains real and can be triggered by local attackers with the ability to create and race AF_UNIX sockets. The violation is classified as a use‑after‑free (CWE‑416) and kernel memory corruption (CWE‑825). It is not recorded in the CISA KEV catalog. Given the local nature of the attack and the requirement for race conditions, the threat is moderate in terms of likelihood but serious in potential damage.