A race condition in the Linux kernel between an af_unix socket connect and a BPF sockmap update can trigger a null pointer dereference. The bug occurs when the socket's state is marked as TCP_ESTABLISHED before the peer is assigned, allowing sock_map_sk_state_allowed() to assume a valid peer and later dereference a NULL reference in unix_stream_bpf_update_proto(). The result is a kernel panic, leading to a denial of service. The weakness is a null pointer dereference that also involves a concurrency race, making it a significant kernel‑level flaw.

The vulnerability affects all Linux kernels that have not applied the patch from commit 041eb6348d73ee5e15fc8161f1eac5a6e8289ca0. There is no specific product version list provided in the data, so any distribution running an unpatched kernel is potentially impacted.

The CVSS score is not supplied, but the null deref leads to a high‑severity impact. EPSS data is not available, so the exploitation probability cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector requires a local process that can load or attach BPF programs that perform sockmap updates, indicating that the threat is limited to hosts with such privileges. However, because the race occurs on ordinary socket connect calls, an attacker who can control BPF updates can induce the crash on any affected system, giving the flaw a potentially serious, though not automatically exploitable, impact.