The Linux kernel previously allowed a TLS socket to be bound to a sockmap (BPF psock) without fully validating the TLS keys, creating a race condition where an attacker could interleave the addition of TLS parameters with the sockmap installation. This race can lead to subtle kernel state corruption or escalation of privileges. The CVE description explicitly states that these latent bugs were exploitable, so the impact is potentially an escalation of local privileges or data integrity compromise. The nature of the weakness aligns with CWE‑362 (Race Condition) and CWE‑413 (Buffer Over‑read).

All Linux kernels that include the sockmap feature and TLS socket support before the commit that introduces the rejection logic (commit 460e6486617c17dd19abe8f3fc67d9a6fa25f8ca) are affected. Administrators should identify if their running kernel includes the vulnerable code by checking the kernel version or the presence of the commit. The issue is not tied to a specific vendor beyond the Linux kernel itself.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a local user with sufficient privileges to create both a TLS socket and a sockmap, and the attacker would need to time the race condition precisely. Given the lack of publicly known exploits and the low EPSS, the risk is considered low while technical feasibility remains. The most likely attack vector is local privilege escalation within a system that uses the sockmap and TLS socket functionality.