The Linux kernel contains a flaw in the af_unix implementation where attempting to process a zero‑length buffer that causes manage_oob() to return NULL leads unix_stream_read_generic() into a busy‑wait loop. When a process issues recv(0, MSG_PEEK) on a socket that is blocking, the kernel immediately returns 0, wasting CPU cycles and potentially stalling normal socket operations. This local resource exhaustion can degrade system responsiveness and create a denial‑of‑service scenario without compromising data integrity or confidentiality.

Linux kernel on all supported releases, as the affected code resides in the core af_unix subsystem. Any running kernel that contains this af_unix implementation—until the patch is applied—is potentially impacted, regardless of specific version numbers.

The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1 %, meaning very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Classified as CWE‑835. The likely attack vector is a local user or a process with privileges that can write to a Unix domain socket. While no public exploits have been documented, an attacker could send a crafted zero‑length out‑of‑band message to a sensitive socket, causing the kernel to spin and consume CPU resources, thereby impacting overall system availability.