The vulnerability allows a listener socket that has been migrated within a SO_REUSEPORT group to fail to notify waiters on the target listener after migration. When this occurs, poll or epoll waiters and blocking accept callers can hang indefinitely, blocking services that rely on socket acceptance. This missing notification is a race condition in the kernel's TCP listener migration code, making the affected systems vulnerable to service disruption. The weakness conforms to "CWE‑821: Improper Synchronization".

All installations of the Linux kernel that ship the TCP SO_REUSEPORT listener migration code are affected. Because no specific kernel version is enumerated in the data, every vendor or distribution that uses the stock Linux kernel before the patch is impacted. Users should verify whether their kernel version incorporates the corresponding commit referenced in the advisory and upgrade if it does not.

The vulnerability carries no KEV designation and its EPSS score is less than 1%, indicating a very low probability of exploitation by known attacks at this time. The threat is still significant because any process with kernel access can create listening sockets with SO_REUSEPORT and trigger the migration race, causing a service that performs accept operations to stall. The impact is confinement to a local or potentially remote process that can reach the listening sockets, so while the attack vector is inferred as local or remote service interaction, that inference is based on the nature of the bug rather than explicit documentation. The CVSS score is 7.8, indicating a high severity impact, so it is prudent to treat the exploit likelihood as low in environments that expose services to untrusted input.