The flaw exists in the Linux kernel function tcp_bpf_sendmsg() used by BPF and sockmap features. When two threads send data on the same socket concurrently, the function records a reference to the message buffer (msg_tx) across a call that releases and later re‑acquires the socket lock. If a second thread completes its own cork operation during that wait, the shared cork buffer is cleared and freed while the first thread still holds a stale reference. The error path then compares the stale cork value with the local temporary buffer, mistakenly identifies the freed buffer as local, and frees it again. This double free triggers a use‑after‑free condition detected by KASAN, causing kernel memory corruption that could crash the system or corrupt kernel data structures. The vulnerability is classified under CWE‑825 (Improper Handling of Uninitialized Memory).

Any Linux kernel version that implements the vulnerable tcp_bpf_sendmsg() before the patches incorporated in the commit chain referenced in the advisory is affected. Since the fix was merged into all current upstream kernels, systems running older kernels that have not been updated are at risk. Linux distributions that ship or maintain unpatched kernels of such versions, including Alpine, Ubuntu, CentOS, RHEL, Debian, Fedora, SUSE, and others, may have impacted installations if their packages contain the vulnerable code.

The CVSS score of 7.8 attests to high severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The attack surface is narrow: it requires two overlapping send operations on the same socket, which in practice corresponds to concurrent traffic over the same TCP connection managed by the kernel. No details in the advisory indicate a viable remote exploitation path or that privilege escalation is feasible without additional conditions.