A race condition in the Linux kernel’s BPF sockmap handling for Unix domain sockets allows a use‑after‑free when a socket is torn down while a BPF iterator runs. The stale peer pointer can cause a kernel panic, shutting down the entire system. The flaw is a local vulnerability that requires the ability to load or execute a BPF program, and it is not publicly listed in CISA’s KEV catalog.

All Linux kernel releases that have not yet incorporated the state‑lock change in unix_stream_bpf_update_proto are vulnerable. The issue appears in the core kernel, affecting every distribution that ships an unpatched kernel version.

The CVSS base score is not published, but the description indicates a severe impact: a successful exploit can bring the system down. Local or privileged users who can load custom BPF programs are required to trigger the race. EPSS information is unavailable, making it unclear how commonly this bug is targeted, but the use‑after‑free nature suggests a high risk of critical system failure if exploited.