The vulnerability occurs in the Linux kernel's network handshake handling. During a TLS handshake, a consumer can cancel the request after it has been removed from the pending list but before the accept side pins the associated file. Because the socket and file structures are reference‑counted independently, the accept side may dereference a NULL or freed socket or file object, giving an attacker the ability to trigger arbitrary memory reads or writes and potentially execute code or crash the system. The flaw is a classic use‑after‑free (CWE‑825) caused by inadequate reference counting that allows a race condition between handshake cleanup and accept processing.

The affected product is the Linux kernel. Vendor information is provided as "Linux:Linux", indicating all kernel builds that include the net/handshake path. No specific version range is supplied, so any kernel that contains the unpatched handshake code is potentially vulnerable until the fix is applied.

The CVSS score is 9.8, indicating critical severity. The EPSS score is less than 1%, suggesting that while the flaw is severe, current exploitation activity is low or not yet observed. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploits have been reported up to the time of this analysis. The likely attack vector is a remote TLS handshake cancellation that occurs before the accept side pins the file reference; this inference is based on the description of the race between handshake_req_next() and handshake_req_cancel(). The conclusion that the flaw can be exploited remotely over the network is inferred rather than explicitly stated in the description, but it follows from the fact that the attacker can manipulate TLS handshake requests from user space. This inference indicates a serious risk for servers hosting TLS services.