In Linux kernels, multicast packets may be handled with a socket that has been prefetched by BPF or UDP early demultiplexing. The code does not maintain a reference to that socket while the packet is processed; this is a reference counting flaw (CWE-825). If the socket the kernel later frees the packet buffer and dereferences a stale socket pointer in sock_pfree(), causing a use‑after‑free kernel crash.

The vulnerability exists in all Linux kernel builds that contain the multicast forwarding logic with the buggy reference handling. This includes the mainline Linux kernels shipped by distributions as well as any custom or patched kernels that have not applied the official fix. No specific kernel release numbers are provided in the CVE record, so any kernel version that predates the patch and still contains the affected code paths is at risk.

The CVSS score of 5.9 denotes moderate severity, and the EPSS indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the trigger requires multicast traffic that is not locally deliverable, an attacker could send crafted multicast packets onto a vulnerable interface. The lack of public exploitation examples suggests that exploitation may be difficult, but the risk remains if malicious multicast traffic can be injected by a remote or local attacker.