The vulnerability causes the kernel to retain a reference to a TCP socket when a policy failure occurs during packet reception, for both IPv4 and IPv6. This leads to a memory leak of tcp_tw_bucket structures, allowing the system to consume increasing amounts of kernel memory as packets are dropped. The consequence is a gradual depletion of available memory that can degrade performance or trigger a denial of service if the leak is extensive.

Linux kernel as a whole is affected. All distributions shipping a kernel before the patch in the linked commits are vulnerable; the advisory does not enumerate specific affected versions.

The CVSS score is 7.5 and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. It is inferred that a sustained memory leak can lead to denial of service. The likely attack vector involves generating network traffic that causes PSP policy failures in a target system running a vulnerable kernel; because the flaw does not enable arbitrary code execution, an attacker would need to craft such traffic to exploit the leak.