A use‑after‑free weakness, classified as CWE‑825, was discovered in the Linux kernel’s TCP implementation. The flaw occurs when the tcp_send_synack() function replaces the original SYN packet in the retransmit queue with a clone, freeing the old skbuff but leaving the retransmit_skb_hint pointer still referencing the freed object. The dangling hint is later dereferenced during retransmission verification, leading to a kernel panic and memory corruption. While remote code execution is not directly enabled, an attacker could crash the kernel to cause denial of service, and the memory corruption could serve as a foothold for further exploitation if combined with other vulnerabilities.

All installations of the Linux kernel are potentially affected, as the vulnerability resides in the core TCP implementation. No specific kernel releases are listed in the CVE data, so any deployment using the standard kernel should assume risk until a patch is applied.

The CVSS score is 8.8, indicating high severity. The EPSS score is < 1%, signifying a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an unprivileged client using TCP Fast Open to manipulate ICMP fragmentation‑needed messages, requiring remote, unprivileged access to trigger a crash. While the impact could be significant—reboot and service interruption—successful exploitation for arbitrary code execution is not confirmed in the provided description.