The flaw is a use‑after‑free in the sk_msg_recvmsg() routine when the udp_bpf_recvmsg() function no longer holds the lock_sock() guard. This race allows multiple threads to access the same sk_msg concurrently, enabling a malicious actor to trigger a dereference of freed memory, which results in a kernel crash. The vulnerability is therefore considered a critical kernel memory corruption flaw.

The defect exists in the Linux kernel; any kernel installation that has not been updated to include the patch that re‑introduces lock_sock() in udp_bpf_recvmsg() is affected. The patch is available in recent kernel releases, so systems running older kernels retain the risk.

Based on the description, attackers might trigger the race by sending crafted or high‑volume UDP packets that invoke BPF read operations while other threads access the socket. Although no public exploits have been reported and the vulnerability is not listed in the CISA KEV catalog, the kernel use‑after‑free presents a high advisory risk due to potential for kernel crashes. The CVSS score of 7.8 indicates a high severity, and the EPSS score of < 1 % suggests a low likelihood of exploitation in the wild. Nevertheless, the presence of a race condition means that exploitation could be feasible, especially in environments with highly concurrent traffic.