The Linux kernel contains a race condition in the net/handshake module that allows a file descriptor reference to be prematurely released while the handshake is still in progress. The result is a use‑after‑free of the socket’s file structure, potentially corrupting kernel memory. The CVE description does not explicitly state that code execution is guaranteed, but a use‑after‑free can be a stepping‑stone to arbitrary execution if an attacker can craft suitable inputs. The impact is therefore described as memory corruption with the possibility of further escalation, inferred from the nature of the flaw.

All Linux kernel releases that do not incorporate the patch commits (e.g., commit 09dba37ee… and later merges) are vulnerable. This includes kernels built directly from upstream mainline by distributions or custom builds that omit the fix.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1%, suggesting that at the time of analysis exploitation activity is limited, though the issue is still widely publicly known. It is not listed in the CISA KEV catalog. The attack vector is inferred to involve malicious netlink handshake messages sent by a process that can invoke the handshake API, potentially from a local user or from a network‑reachable source if netlink traffic is exposed. The exploitation requires a timing win but the narrow window does not preclude advanced attackers.