A concurrency flaw in the Linux kernel enables the bpf_iter_unix_seq_show() function to deadlock when lock_sock_fast() takes the fast path and a BPF program attempts to update a sockmap. The deadlock manifests as a recursive lock acquisition on the AF_UNIX socket lock, causing the kernel to spin and potentially freeze a process or the system. The primary impact is a service disruption (DoS) that can affect any process interacting with BPF sockmaps, but does not directly compromise confidentiality or data integrity.

All Linux kernel builds that contain the affected bpf and sockmap code prior to the commit fix. No specific version range is listed, so any kernel version before the patch could be vulnerable, especially those exposing BPF sockmap functionality.

The CVSS score is not disclosed, and EPSS is not available, so the quantitative risk is uncertain; however, the vulnerability causes a deadlock which is a deterministic DoS condition. The attack likely requires local execution of a crafted BPF program or influence over sockmap updates, and may be achievable by users with sufficient privileges to load BPF programs. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation, but the potential for local denial of service remains significant.