The described flaw is a use‑after‑free (UAF) condition in the Linux kernel’s socket‑cloning routine. When a socket is cloned and an early bailout occurs, the new socket’s BPF storage pointer still references the parent socket’s storage. If the new socket is freed before the pointer is cleared, the parent’s BPF data is freed while still in use, potentially allowing an attacker to read or overwrite kernel memory, leading to arbitrary kernel code execution. The vulnerability is confined to kernel space and would require the attacker to trigger the cloning path, implying local or system‑level privilege escalation. The underlying weakness is a classic pointer handling bug, catalogued as CWE‑416.

The flaw affects Linux kernel implementations. Specific product names are listed as "Linux:Linux" in the CNA data, and affected kernel versions are not enumerated in the CVE record, so any system running a kernel prior to the commit that introduced the patch is potentially vulnerable.

The CVSS score is not supplied, and no EPSS estimate is available, while the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, a use‑after‑free in the kernel can be leveraged to gain elevated privileges, a highly severe outcome. The likely attack vector is a local one, as the flaw is triggered by socket operations that a user process can initiate. Exploitation would require the attacker to create a socket with BPF filters that trigger the early bailout condition, then arrange for cleanup of the new socket. While the CVE description does not detail the full exploit chain, the presence of a kernel UAF indicates a severe, high‑impact risk if an adversary can meet the prerequisite conditions.