The Linux kernel contains a flaw where the BPF helpers bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie assume their socket pointer refers to a full socket and access the sk_protocol field without first verifying that the socket is in a full‑socket state. When the pointer actually refers to a mini‑socket, the code dereferences fields that are not defined for that object, which can trigger a kernel panic. The resulting impact is a loss of availability for the affected system; there is no evidence of arbitrary code execution or data corruption.

All Linux kernel deployments that support the BPF subsystem and expose the bpf_tcp_gen_syncookie or bpf_tcp_check_syncookie helpers are potentially affected. The advisory does not specify an exact version range, so any kernel prior to the patch that contains this helper code may be vulnerable. Review your distribution’s security mailing lists or vendor release information to determine which kernel packages include the fix.

The EPSS score of < 1% and the CVSS score of 7.3 indicate a high but limited probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, which suggests no widespread exploitation has been observed. The flaw is likely exploitable only locally: an attacker who can run a BPF program with sufficient privileges to supply a malformed socket pointer could trigger the crash. Because the attack requires interaction with the kernel’s BPF helper, the complexity is moderate, but the potential for service disruption is high.