A use‑after‑free condition exists in the Linux kernel’s TCP Autonomous Operation delete routine. When a key is removed asynchronously after the socket has transitioned to LISTEN, the pointers current_key and rnext_key are not cleared before the key slab is freed, causing subsequent getsockopt(TCP_AO_INFO) calls to read invalid memory. This memory corruption can crash the kernel or corrupt data, exposing the system to a denial‑of‑service attack. The flaw is a classic use‑after‑free weakness (CWE‑825).

All Linux kernel implementations that include the TCP AO feature are vulnerable, as the affected code path exists in the core kernel. Specific vendor or version information is not listed in the CVE data; therefore, any kernel with the TCP AO feature before the CVE fix is potentially exposed. The mitigation requires a patch to the kernel source, so any distribution kernel that has not applied the fix remains at risk.

The vulnerability carries a CVSS score of 7.8 and an EPSS score of less than 1 %, indicating a moderate severity but a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is local privileged execution that manipulates the kernel’s TCP AO key state to trigger the use‑after‑free. Exploitation would most likely require local privileged access or the ability to manipulate the kernel’s TCP AO state; it is unlikely to be exploitable remotely or by unauthenticated users.