The kernel bug miscalculates the TCP Fast Open queue length when a listener socket using SO_REUSEPORT is migrated. The accounting code increases the counter for the new listener while decreasing it for the old one, leaving the counter negative and the limit ineffective. Based on the description, it is inferred that an attacker can provoke such a migration, which would enable the kernel to accept an unchecked number of pending Fast Open connections, exhausting resources and potentially crashing the system.

Linux kernel builds that enable TCP Fast Open and SO_REUSEPORT are affected. The advisory does not specify exact kernel versions; any distribution that ships the default kernel is potentially vulnerable until the patch is applied.

The CVSS score of 7.5 indicates moderate to high severity. Public exploitation data is absent and the EPSS score is <1%, suggesting no known exploit in the wild. The likely attack vector is triggering listener migration, typically by restarting or manipulating server processes. Based on the description, it is inferred that this action is required for exploitation, so it is unlikely to be widely exploited. Nonetheless, the unchecked resource allocation provides a clear denial of service vector, and administrators should consider the vulnerability as medium to high risk until a patch is deployed.