The vulnerability arises when the Linux kernel’s BPF TCP iterator releases socket references twice during a batch reallocation failure. The first release frees the socket pointers, while a subsequent release mistakenly dereferences a cookie as a socket structure, leading to a null‑pointer dereference in __sock_gen_cookie. This error triggers a kernel panic, causing an abrupt system crash and denying availability to all processes on the affected host.

Both architectures of the Linux kernel are susceptible. The specific versions affected are those released before the patch that fixes the double release logic in the bpf_iter_tcp_batch handling code. Vendors should verify whether their deployed kernel falls into this pre‑patch range.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly known exploitation. However, the bug is a classic use‑after‑free scenario (CWE‑416) that can crash the kernel if an attacker can trigger the batch reallocation path—typically through malicious BPF programs with sufficient privileges. The likelihood of exploitation remains uncertain, but the impact of a successful attack is catastrophic for system availability.