A flaw in the Linux kernel’s BPF TCP iterator leads to a double release of socket references when a batch reallocation fails, causing a null‑pointer dereference during cookie processing. The exploit appears to result in a kernel panic, abruptly halting the system and denying availability to all processes. The vulnerability is a classic use‑after‑free (CWE‑416) combined with a duplicate release of resources (CWE‑825).

All Linux kernel builds that predate the commit that fixes the double‑release logic are affected. No specific version numbers are provided, so any kernel older than the patch can potentially be vulnerable; administrators should verify the running kernel against vendor release notes for the update.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% and absence from the CISA KEV catalog suggest low likelihood of widespread exploitation. Based on the description, it is inferred that an attacker with privileges to load or modify eBPF programs could trigger the vulnerable path, leading to a kernel crash. The attack requires that a BPF program exercise the TCP iterator’s batch reallocation, implying that exploitation is limited to environments where such programs are allowed.