The vulnerability in the Linux kernel occurs when a BPF socket iterator attempts to read the sk_protocol field from a struct sock_common instance, but that field actually resides in struct sock. When a TIME_WAIT or NEW_SYN_RECV socket is passed to bpf_sock_destroy(), the code reads past the end of the object, triggering a KASAN out‑of‑bounds error and typically causing a kernel crash. This flaw represents an out‑of‑bounds read (CWE‑125) that can result in denial of service by crashing the kernel or applications that rely on socket state.

All versions of the Linux kernel released before the patch that incorporates commit 01b245ba (or any equivalent revision) are affected. The vulnerability is present in the Linux kernel across all supported architectures that implement BPF socket iterators. The product is the Linux kernel distributed by the Linux Foundation.

The advisory lists an EPSS score of <1% and the vulnerability is not in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The CVSS score of 5.5 denotes moderate severity. Exploitation requires loading a malicious BPF program that accesses sockets via the iterator interface, a capability normally limited to privileged users. An attacker who can inject the program could trigger an out‑of‑bounds read, leading to a kernel crash and availability disruption, but the practical risk remains moderate until the patch is applied.