A refcount underflow and subsequent use‑after‑free can occur in the Linux kernel when the TCP request socket code is executed while PREEMPT_RT is enabled. The bug occurs if a timer expires between a mod_timer call and a refcount_set, causing a request socket to be freed after its reference counts have already been decremented; this leaves dangling pointers in kernel memory that an attacker can potentially exploit to corrupt data or gain privilege. This race condition between timer expiration and reference count manipulation is a classic concurrency flaw (CWE-362).

Linux kernel builds that include the affected TCP request‑socket handling code and are compiled with PREEMPT_RT enabled before the patch that adds preempt_disable_nested()/preempt_enable_nested() around the mod_timer and refcount_set calls. Any kernel released before those changes may be affected.

The flaw is a classic use‑after‑free caused by a race condition (CWE-362), which can lead to privilege escalation or a kernel crash if an attacker is able to craft a network packet that triggers the condition. The likely attack vector is remote network traffic that creates TCP request sockets while PREEMPT_RT is in effect. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, so the exact exploitation probability is uncertain, but the severity is high, with a CVSS score of 9.8.