The flaw arises because three single‑bit flags—killed, freed, and out_of_sync—share one byte in the smc_connection structure. Each flag is updated independently without a common lock, causing read‑modify‑write operations that race between tasklet and process context code. When the race occurs, the kernel may store an invalid or stale value for one flag while leaving the others unchanged, resulting in inconsistent socket state. The impact is limited to corrupted socket behavior, which can lead to denial of service or subtle instability but does not provide a direct path to privilege escalation or remote code execution. The CVSS score of 4.8 is reflected in the low‑to‑medium severity classification.

All Linux kernel installations that have not incorporated the patch referenced by commit 2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec are affected. The vulnerability resides in the generic kernel code and applies to every distribution that ships with an unpatched kernel containing the shared‑byte implementation of the SMC protocol.

The CVSS score of 4.8 and the absence of a publicly available EPSS value indicate a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog and no active exploits are known. Attackers can trigger the race by sending crafted SMC packets from local or network sources that touch the affected connection structure, potentially leading to unstable socket behavior or kernel crashes, but the risk of exploitation remains modest.