A memory safety flaw in the Linux kernel's TCP stack allows an out‑of‑bounds read of a tcp_timewait_sock structure inside the tcp_ao_established_key() function. The flaw is triggered when the lockdep_sock_is_held() assertion is invoked on a socket lacking the expected sk_lock field, leading to an invalid memory access that can cause a kernel panic and bring the system down. This constitutes a denial‑of‑service vulnerability with potential for any system running the affected kernel.

The flaw exists in any Linux kernel build that contains the incorrect lockdep assertion in tcp_ao_established_key() prior to the patch commit 03cb001ef87b3f8d859cf7f96329acf3d6235d29. All distributions shipping a vulnerable kernel version are affected; the specific affected releases are not listed due to lack of detailed version data.

The EPSS score is <1% and the vulnerability is not in the CISA KEV catalog, indicating low likelihood of widespread exploitation. However, an attacker would need to deliver crafted network traffic that triggers tcp_v[46]_timewait_ack() and invokes the faulty function, making the attack complex but feasible. If executed, the consequence is a local or remote denial of service caused by a kernel panic.