The flaw arises when the Linux kernel frees MD5 authentication data in tcp_connect() before the required RCU grace period has elapsed. Readers executing at softirq or in other contexts can access the freed memory, resulting in a use‑after‑free. An attacker who can influence outbound TCP connections may trigger the race and cause arbitrary code execution with kernel privileges. The weakness is a classic use‑after‑free identified as CWE‑825.

All Linux kernel configurations that lack the commits replacing bare kfree() with kfree_rcu() for md5sig_info and tcp_md5sig_key, and that do not make tcp_clear_md5_list RCU‑safe, are vulnerable. Any system running a kernel version prior to these changes, regardless of distribution or patch level, is subject to the vulnerability. The vulnerability does not depend on specific kernel modules beyond the TCP stack.

The CVSS score of 9.8 signals critical severity, and the EPSS score of <1% indicates a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote network attacker who can initiate outbound TCP connections; by carefully timing the packets, the attacker can enforce the race and exploit the use‑after‑free. The latent conditions make exploitation difficult, but the high severity warrants prompt action.