The Linux kernel contains a use‑after‑free bug in the BPF TCP iterator used by __bpf_iter_tcp_established_batch. The function holds a bucket lock and then calls sock_hold() on a request socket that may still have a reference count of zero, which is later overwritten by refcount_set(). This allows the reference count to be incremented from zero, resulting in a dangling reference that can be exploited to corrupt memory or trigger a kernel panic. The weakness is a classic use‑after‑free, classifying it as CWE‑911.

The flaw exists in the Linux kernel itself, with the CNA listing the Generic Linux kernel as the affected product. No specific version numbers are supplied, which implies that any kernel builds containing the buggy iteration routine before the fix are vulnerable. All current kernels that expose BPF TCP iteration functionality without the patch are at risk.

The CVSS score is 7.8 and the EPSS value is <1%, and the KEV database does not list this vulnerability as a known exploited flaw. The lack of public exploitation data combined with the severity of a use‑after‑free suggests a moderate to high risk: an attacker could induce the bug by rapidly opening and closing TCP connections while enumerating established sockets via BPF, leading to memory corruption or kernel panic. The exploitation plausibility is increased by the bug’s activation under syncookies disabled, but no confirmed remote exploit is documented.