The flaw occurs in the Linux kernel’s RDS TCP code when the system frees a network‑namespace specific listen socket before unregistering its sysctl table. A concurrent write to the sysctl can race with the teardown; the handler derives the namespace from a field of the socket that has already been freed, causing a slab use‑after‑free. An attacker who can write to the sysctl parameter can trigger this race, potentially executing arbitrary code in kernel mode or crashing the system.

This vulnerability affects all Linux kernel builds that include the unpatched RDS TCP feature. No specific kernel version is listed, so any kernel compiled with the default RDS TCP code may be vulnerable until the patch is applied.

The CVSS score of 7.8 classifies the issue as high severity. An EPSS score of <1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalogue, indicating no publicly known exploits. The race condition requires write access to a kernel sysctl parameter, which typically means a local user or privileged process. While the exploitation probability is currently low, the high severity requires that the issue be patched promptly to avoid potential local privilege escalation.