The kernel mistake allowed any process to attach a Berkeley Packet Filter (cBPF) to a TCP socket using the SO_ATTACH_FILTER option. This could be exploited to leak TCP sequence and acknowledgment numbers, a side‑channel that could enable an timing information. The patch adds a capability check requiring CAP_NET_ADMIN, preventing unprivileged code from attaching the filter. The vulnerability directly concerns confidentiality and the reliability of TCP communications.

The flaw exists in the Linux kernel. Specific vendor or product names are Linux:Linux, with all kernel releases prior to the patch affected. No explicit version range is given in the data, so all unpatched kernels must be considered vulnerable until the restriction is applied.

The CV moderate severity, and the EPSS score of < 1% shows a very low likelihood of exploitation, though the flaw remains not listed in KEV. It can be exploited by any user on a host running an unpatched kernel by creating a socket, calling setsockopt(SO_ATTACH_FILTER) with an arbitrary cBPF program, and reading the filter’s output to glean TCP sequence/acknowledgment to the target system and does not involve remote code execution. The risk to confidentiality is significant, but the lack of a global exploitation dataset makes the likelihood uncertain.