The Linux kernel flaw involves an improper handling of the sk_redir socket reference during BPF socket map send verdict operations. When a sendmsg operation ends and the socket reference is released, a previously cached verdict may still be in use by another thread, causing the socket pointer to be freed while still being dereferenced. This results in a use‑after‑free condition that leads to kernel memory corruption and can crash the system. The vulnerability does not directly grant code execution but can destabilize the kernel, leading to a denial of service. The likely attack vector is a specially crafted BPF send operation that uses the sockmap feature.

All distributions that ship the open‑source Linux kernel. The issue is present in any kernel version that includes the vulnerable sk_redir handling code, with no specific version bounds provided. All architectural variants that compile the BPF socket map feature are affected.

The flaw can be triggered by specially crafted BPF send operations on sockets that use the socket map example. Based on the description, it is inferred that the attack vector requires use of the BPF sockmap feature and can be triggered by sending crafted data through a socket. Although no public exploits are documented and the EPSS score is not available, the crash‑potential nature makes this a high‑severity concern for environments where BPF and socket mapping are enabled. The vulnerability is not listed in CISA’s KEV catalog, and the lack of a mitigation in normal kernel operation means that a system running the vulnerable kernel could experience a crash if the use‑after‑free scenario is triggered by BPF socket operations.