The vulnerability is in the Linux kernel RDS TCP subsystem, where the kernel frees a per‑network‑namespace listen socket before unregistering the corresponding sysctl table. During this teardown, a concurrent write to a sysctl entry can race with the socket deallocation, causing rds_tcp_skbuf_handler to dereference a freed socket. This results in a slab use‑after‑free, which corresponds to CWE‑416, and can also lead to uninitialized value usage (CWE‑825). The memory corruption may crash the kernel or, under favorable conditions, allow execution of arbitrary code with kernel privileges.

Any Linux kernel that contains the RDS TCP module and its sysctl interface is potentially vulnerable until the patch is applied. Existing kernel builds from major distributions, as well as custom kernels that have not yet incorporated the fix, fall into this category.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score is reported as <1%, indicating a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector requires write access to a kernel sysctl parameter, so a local user with permission to modify net.rds.tcp.* values or a privileged process could initiate the race. The presence of a KASAN warning confirms the use‑after‑free; however, no publicly known exploits exist. The risk remains high enough to warrant prompt remediation.