The defect lies in the Linux kernel's phonet networking subsystem, where the pn_socket_autobind() routine incorrectly interprets a successful binding failure as evidence that a socket is already bound. When pn_socket_bind() returns –EINVAL for a socket that has never been bound, the code asserts the port must be non‑zero. The assertion fails, provoking a BUG_ON that crashes the kernel. The vulnerability is exposed through the pn_socket_sendmsg() path, meaning a user‑space process that can create and send data over a phonet socket can trigger the crash. A kernel panic halts all services, producing an immediate denial of service for the entire host.

Any Linux system whose kernel includes the phonet driver before the fix is applied is affected. The patch removes the faulty BUG_ON, so systems running kernel versions built from commits after the change are immune. All distributions using the affected kernel range—any kernel that has not incorporated the change—must be identified and updated.

The exploit requires a local process capable of accessing the phonet socket interface; privileged code or a user with appropriate rights can achieve this. Because the attack triggers a full kernel crash, the impact encompasses integrity and availability of the host, but not confidentiality. No CVSS or EPSS score is disclosed; the vulnerability is not listed in CISA's KEV catalog. Nonetheless the clear path to a kernel panic implies a high potential for local denial of service if an attacker can run code that exercises the buggy path.