A refcount underflow and subsequent use‑after‑free can occur in the Linux kernel when the TCP request socket code is executed while PREEMPT_RT is enabled. The bug occurs if a timer expires between a mod_timer call and a refcount_set, causing a request socket to be freed after its reference counts have already been decremented; this leaves dangling pointers in kernel memory that an attacker can potentially exploit to corrupt data or gain privilege.

Linux kernel builds that include the affected TCP request‑socket handling code and are compiled with PREEMPT_RT enabled before the patch that adds preempt_disable_nested()/preempt_enable_nested() around the mod_timer and refcount_set calls. Any kernel released prior to those changes may be affected.

The flaw is a classic use‑after‑free, which can lead to privilege escalation or a kernel crash if an attacker is able to craft a network packet that triggers the condition. The likely attack vector is remote network traffic that creates TCP request sockets while PREEMPT_RT is in effect. No EPSS score is provided and the vulnerability is not listed in CISA KEV, so the exact exploitation probability is uncertain, but the severity is high due to the kernel nature of the defect.