The Linux kernel implemented a feature that attempted to convert an active TCP socket into an SMC socket by modifying the underlying file, dentry, and inode structures in‑place. This violates VFS invariants that treat these structures as immutable for an open file, creating a use‑after‑free condition and general system instability. An attacker that can trigger the flaw might corrupt kernel memory, leading to system instability. The impact is confined to the kernel's handling of SMC sockets and does not affect unrelated network stacks.

All Linux kernel releases that contained the TCP‑ULP support for SMC before the revert commit (d7cd421da9da2cc7b4d25b8537f66db5c8331c40) were affected. Since the feature was removed in a later commit, any kernel that includes that commit in the upstream source up to the revert is impacted. No specific version numbers are supplied in the data.

The CVSS score of 7.0 denotes medium severity. No exploit code or proof‑of‑concept is documented, and the EPSS score is unavailable, so the exact exploitation likelihood is unknown. Based on the description, the likely attack vector is local or privileged, requiring the attacker to create or manipulate a TCP socket that the kernel will convert to an SMC socket. Because the design flaw violates core VFS invariants, a successful use‑after‑free could lead to system instability. The vulnerability is not listed in CISA KEV catalog.