The flaw is a race condition in the Linux kernel's TIPC UDP bearer logic. Concurrent additions and deletions of peers are performed without proper serialization, which corrupts the replicast list and triggers a kernel BUG that crashes the system. The weakness is a classic concurrent execution race that can be exploited by an unprivileged user to cause a denial of service.

The vulnerability resides in the Linux kernel, specifically within the tipc_udp_rcast_add() and cleanup_bearer() functions in net/tipc/udp_media.c. No explicit kernel version range is supplied, so any release lacking the patch may be affected. All installations that expose the TIPC UDP bearer through generic‑netlink in unprivileged user namespaces are potentially vulnerable.

The advisory does not publish a CVSS score and the EPSS score is unavailable, so a precise quantified risk cannot be given. The flaw can be triggered by an unprivileged user who can send generic‑netlink messages to the TIPCv2 interface. A successful race will result in a kernel panic and complete denial of service. The vulnerability is not listed in the CISA KEV catalog as a known exploited vulnerability.