A race condition occurs in the Linux kernel's IUCV socket implementation. When a user performs getsockopt(SO_MSGSIZE) concurrently with a recvmsg() that closes the socket, the getsockopt code dereferences a pointer that has been cleared by close, causing a null-pointer dereference oops. The result is a kernel crash that brings the host down, leading to a denial of service.

Affected systems are Linux kernel installations that expose the AF_IUCV socket interface and have not applied the locking fix. Any version prior to the commit that wrapped the getsockopt switch in lock_sock()/release_sock() is potentially vulnerable. This includes all kernel releases before the introduction of the commit identified by the hash c1fc30bd4e55e2dd622d2d366cecd732c1841bbee.

The flaw carries a CVSS score of 7.8, classifying it as high severity. The EPSS score is less than 1 %, indicating a low but non-zero likelihood of exploitation. Because the attack requires local access to an AF_IUCV socket, the attack vector is inferred to be local. The vulnerability is not listed in the CISA KEV catalog and no public exploit is known. The crash produces a clear denial‑of‑service on the affected host, but does not leak data or alter system integrity.