The Linux kernel allows a BPF program to insert an unbound UDP socket into a sockmap. When the socket later becomes bound, the kernel omits the expected decrement of its reference count, causing the socket to leak memory. This behavior results in a classic memory‑leak flaw, potentially growing until the system exhausts available memory and becomes unresponsive. The weakness is represented by CWE‑911 (Improper Reference Counting). Based on the description, it is inferred that executing a BPF program requires privileged access such as root or CAP_SYS_ADMIN rights.

All Linux kernel implementations that have not yet incorporated the fix rejecting unhashed UDP sockets during sockmap updates are vulnerable. This includes distributions shipping kernels prior to the commit that introduced the reference‑count handling bug. The issue applies generally to any system running a kernel that accepts unbound UDP sockets in BPF sockmaps.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. Based on the description, it is inferred that the vulnerability requires the privilege to load BPF programs, which typically demands root or CAP_SYS_ADMIN rights. It is not listed in the CISA KEV catalog, implying no widespread, documented exploitation. The potential impact is a local or privileged denial‑of‑service arising from uncontrolled memory growth, rather than remote code execution or data disclosure.