A race condition in the Linux kernel’s handling of Unix domain sockets can lead to a use‑after‑free when the SCC entry is unlinked in unix_del_edge(). The flaw occurs because the kernel may unlink the SCC entry before the related socket buffer is fully queued, leaving a reference to freed memory that can later be accessed during garbage collection. The result is a kernel panic that crashes the operating system, thereby denying availability to any service running on the affected host.

All Linux kernel releases that implement the af_unix SCC handling are potentially affected until a vendor releases a kernel patch that includes the fix for this race condition. No specific version numbers are listed, so any kernel that contains the af_unix SCC code path and has not applied the updated code is at risk.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation. Based on the description, the likely attack vector requires a local attacker with the ability to orchestrate concurrent send() and close() calls on Unix domain sockets to trigger the race. The CVSS score of 7.8 indicates high severity, meaning the risk is largely dependent on local privilege; however, a kernel crash has severe availability implications and could provide a foothold for privilege escalation. Administrators should treat this as a high‑severity local denial‑of‑service risk until the patch is deployed.