A race condition between simultaneous recv calls on an AF_UNIX stream socket in earlier Linux kernel releases can cause unix_stream_data_wait() to dereference a freed socket buffer. The function performs skb_peek_tail without holding the lock protecting the receive queue, and then accesses the freed object's len field. This use‑after‑free triggers kernel memory corruption, which can lead to a system crash and denial of service. The CVE does not state that the flaw leaks data or enables arbitrary code execution.

All Linux kernel implementations older than version 6.5 are impacted, including the widely deployed 5.x series and custom kernels that have not been upgraded to the 6.5 release. The flaw resides in the generic AF_UNIX stream socket handling path, so any system that employs this IPC mechanism with an older kernel is vulnerable.

The CVSS score of 8.8 classifies this as a high‑severity issue, while the EPSS score of less than 1% indicates that exploitation is unlikely at the moment. This flaw does not appear in CISA’s KEV catalog. Exploitation requires an attacker who can create or control an AF_UNIX socket pair and orchestrate a precise timing race between a peeked and a normal receive operation; such conditions make reliable exploitation challenging. If an attacker succeeds, the kernel memory corruption can cause a crash and denial of service. No evidence is provided that the flaw enables privilege escalation.