The kernel bug miscalculates the TCP Fast Open queue length when a listener socket using SO_REUSEPORT is migrated. The accounting code increases the counter for the new listener while decreasing it for the old one, leaving the counter negative and the limit ineffective. An attacker who can provoke such a migration can therefore cause the kernel to accept an unchecked number of pending Fast Open connections, exhausting resources and potentially crashing the system.

Linux kernel builds that enable TCP Fast Open and SO_REUSEPORT are affected. The advisory does not specify exact kernel versions; any distribution that ships the default kernel is potentially vulnerable until the patch is applied.

Public exploitation data is absent and the EPSS score is not available, suggesting no known exploit in the wild. The defect requires an attacker to trigger listener migration, typically by restarting or manipulating server processes, so it is unlikely to be widely exploited. Nonetheless, the unchecked resource allocation provides a clear denial of service vector, and administrators should consider the vulnerability as medium to high risk until a patch is deployed.