The vulnerability arises when the Linux kernel’s BPF TCP iterator releases socket references twice during a batch reallocation failure. The first release frees the socket pointers, while a subsequent release mistakenly dereferences a cookie as a socket structure, leading to a null‑pointer dereference in __sock_gen_cookie. This error triggers a kernel panic, causing an abrupt system crash and denying availability to all processes on the affected host.

Both architectures of the Linux kernel are susceptible. The specific versions affected are those released before the patch that fixes the double release logic in the bpf_iter_tcp_batch handling code. Vendors should verify whether their deployed kernel falls into this pre‑patch range.

EPSS indicates a very low exploitation probability of less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly known exploitation. The CVSS score of 7.8 reflects a high impact. However, the bug involves improper resource management, consistent with CWE-825, that can crash the kernel if an attacker triggers the vulnerable batch reallocation path. Based on the description, it is inferred that the likely attack vector is through malicious BPF programs with sufficient privileges. The likelihood of exploitation remains uncertain, but the impact of a successful attack is catastrophic for system availability.