The vulnerability occurs in the Linux kernel TCP stack when a child socket inherits the listener’s BPF sock_ops callback flags. If the child socket setup fails, the socket is freed while the kernel’s synchronization locks are not held. When tcp_done processes the socket, it calls tcp_set_state, which triggers tcp_call_bpf. Because the expected lock is missing, a sock_owned_by_me assertion is hit, producing a warning and potentially a kernel panic. The kernel crash results in denial of service, taking the affected host offline until a reboot or recovery action is performed.

All Linux kernel builds that include the unpatched TCP code path are affected. The issue is present in the Linux kernel prior to the inclusion of the patch from commit 8874dafc9099bc49c2e5ebba030f85d276421f92; the specific release versions are not listed, so any kernel older than the commit that implements this fix is potentially vulnerable.

The bug is a race condition that leads to kernel panic when a child socket is force‑closed after a failed SYN setup while inheriting BPF callback flags. The likely attack vector is remote network traffic that creates many short‑lived connections to trigger the code path. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating that public exploitation is limited or not yet observed. However, because the flaw can cause a kernel crash on any host that processes affected connections, the risk is significant for systems where the kernel has not been updated. If the affected host is reachable over the network and sends or receives a large influx of TCP packets, an attacker could trigger a denial of service. The CVSS score of 9.8 highlights the critical severity, and while the exploitation probability is low, the impact is catastrophic.