A non‑exact in‑window reset packet received while a TCP connection is waiting for a SYN‑ACK causes the kernel to drop the pending request instead of sending the required challenge ACK. The protocol anomaly results in legitimate connections being terminated prematurely, which creates a denial‑of‑service condition for applications relying on that connection. The flaw is an instance of improper input validation and improper handling of packet sequencing.

All Linux kernel builds that have not applied the commit series fixing the issue are affected. The vulnerability resides in the core TCP implementation, so any distribution or custom kernel configuration that still contains the unpatched code is at risk.

The high severity CVSS score of 8.2, combined with a low EPSS score of less than 1%, indicates that while the flaw is serious, active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known live attacks. Exploitation requires an attacker to inject a forged TCP reset packet that does not match the expected sequence number, a remote network attack that disrupts service for victims.