The Linux kernel allows a BPF program to add an unbound UDP socket to a sockmap. When the socket later becomes bound, the kernel’s reference‑count decrement is omitted, causing the socket to leak memory. This memory leak can grow until the system runs out of memory, potentially leading to a denial‑of‑service for local or remote users with the ability to load BPF programs. The weakness is a classic memory‑leak error (CWE‑401).

Any Linux kernel that has not yet incorporated the fix that rejects unhashed UDP sockets on sockmap updates is affected. This includes distributions shipping kernels prior to the patch that addresses the ref‑count mishandling introduced in the commit noted in the advisory.

The CVSS score is not listed, and EPSS data is unavailable, but the vulnerability requires the privilege to load BPF programs, usually CAP_SYS_ADMIN or root. Because of this privilege requirement the threat is primarily local or for environments where privileged code can be introduced. The vulnerability is not in CISA KEV catalog, suggesting no widespread exploitation. Nevertheless, any system that accepts unbound UDP sockets in BPF sockmaps should consider the risk of memory exhaustion and treat the issue as a moderate to high impact when privilege is compromised.