The vulnerability resides in the TIPC (Transparent Inter‑Process Communication) subsystem of the Linux kernel. When tipc_sk_create() fails to insert a new socket due to the per‑netns socket hash table reaching its maximum size, the error path frees the socket descriptor but does not null out sock->sk. A subsequent release of the pre‑allocated child socket that was created during an accept() call dereferences this dangling pointer. This results in a use‑after‑free of the socket lock spinlock, which the kernel treats as a slab corruption that can crash the system or be leveraged for privilege escalation by an attacker who can trigger the failure condition. The flaw is limited to local users that can manipulate TIPC sockets; it does not require remote network access but can be used to bring the kernel down or escape to elevated privileges.

All Linux kernel builds that shipped the vulnerable code before the patch commit 5f5a41a48dbf9eda57b67ce23e548602cf7195a6. The mismatch is present in any distribution that has not applied the latest kernel releases correcting the TIPC socket insert path. The patch is included in the mainline kernel after the mentioned commit; any kernel older than that commit is vulnerable.

The CVSS score is not specified in the public data, and the EPSS score is unavailable, so an exact quantitative risk is not provided. However, the flaw can cause a kernel panic via use‑after‑free, which is considered a high severity denial‑of‑service and a potential privilege‑escalation vector. The KEV catalog does not list this CVE, suggesting no widely known active exploits at the time of publication. The likely attack vector is a local user creating a large number of TIPC sockets to exhaust the hash table and trigger the failed‑insert path. The kernel release notes confirm that a patch intended to clear sock->sk on failure was applied in subsequent versions. Third‑party mitigations are not documented beyond the patch.