This vulnerability resides in the Transparent Inter‑Process Communication (TIPC) subsystem of the Linux kernel. When tipc_sk_create() fails to insert a new socket because the per‑netns socket hash table reaches its maximum size, the error path frees the socket descriptor but leaves sock->sk pointing at the freed object. A later release of the pre‑allocated child socket created during an accept() call dereferences this dangling pointer, resulting in a use‑after‑free of the socket lock spinlock. The flaw has a CVSS score of 9.8, indicating critical severity.

All Linux kernel builds that shipped the vulnerable code before the patch commit 5f5a41a48dbf9eda57b67ce23e548602cf7195a6. The mismatch is present in any distribution that has not applied the latest kernel releases correcting the TIPC socket insert path. The patch is included in the mainline kernel after the mentioned commit; any kernel older than that commit is vulnerable.

The CVSS score is 9.8, and the EPSS score is less than 1%, indicating a very low likelihood of exploitation in the wild. This vulnerability can lead to a kernel panic via use‑after‑free, which is a high‑severity denial‑of‑service and may allow privilege escalation if local attackers can trigger the failure condition. The KEV catalog does not list this CVE, suggesting no known active exploits at the time of publication. The likely attack vector is a local user creating a large number of TIPC sockets to exhaust the hash table and trigger the failed‑insert path. The kernel release notes confirm that a patch intended to clear sock->sk on failure was applied in subsequent versions. Third‑party mitigations are not documented beyond the patch.