The flaw occurs when a socket is inserted into a BPF socket map (BPF_SK_SKB_VERDICT) before its TLS receive context is configured. A missing guard in sk_psock_verdict_data_ready() races with TLS strparser logic, draining the receive queue without advancing the copy sequence number. The subsequent TLS decryption pathway then processes a stale, freed socket buffer, causing a kernel use‑after‑free condition that can corrupt memory or crash the system. An attacker who can load a custom BPF program that manipulates socket maps or inject data into a TLS connection can trigger this race, potentially leading to kernel corruption, denial of service, or privilege escalation.

All Linux kernels before the inclusion of commit e91de6afa81c are impacted. This includes all releases predating that commit in which the socket map race condition remains unguarded. Users running Linux kernel versions older than the fix and hosting BPF programs that target socket maps remain vulnerable.

The CVSS score of 9.8 marks this issue as critical, while the EPSS score of <1% indicates a very low probability of discovery or exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation requires local kernel privilege or the ability to load BPF programs that access socket maps, limiting the attack surface to privileged or compromised systems. Successful exploitation could result in arbitrary memory corruption or kernel crash, potentially enabling privilege escalation if additional conditions are met.