The flaw arises in the Linux kernel when a socket is placed into a BPF socket map (BPF_SK_SKB_VERDICT) before the socket’s TLS receive context is configured. A missing guard in sk_psock_verdict_data_ready() races with the TLS strparser’s handling of incoming data, draining the receive queue without advancing the copy sequence number. Subsequent TLS decryption logic reads a stale, freed socket buffer, producing a kernel use‑after‑free condition that can corrupt memory. An attacker who can load a BPF program capable of manipulating sockets or inject data into a TLS connection can trigger this race, potentially leading to kernel corruption, denial of service, or privilege escalation. The vulnerability is tied to a specific commit, e91de6afa81c, which adds a guard to sk_psock_verdict_data_ready(). All Linux kernel versions prior to this commit that still lack the guard are vulnerable.

All users running a Linux kernel prior to the inclusion of commit e91de6afa81c are affected. The vulnerability impacts the Linux kernel’s handling of BPF socket maps (BPF_SK_SKB_VERDICT) and TLS reception logic. No specific version ranges are listed; any kernel that predates the applied commit remains vulnerable.

The CVSS score of 9.8 marks the issue as critical, while the EPSS score of <1% indicates a very low likelihood of discovery and exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local kernel privilege or the ability to load custom BPF programs that access socket maps, restricting the attack surface to privileged or compromised systems. Nevertheless, the memory corruption could enable arbitrary code execution or a system crash if successfully leveraged.