The Linux kernel bug allowed a BPF sock_ops program that accessed the rtt_min field of a socket struct without validating the socket type to perform an out‑of‑bounds read. This access can pull in adjacent kernel memory, exposing kernel pointers and other sensitive information. The flaw is a classic out‑of‑bounds read (CWE‑125) that has been mitigated by patching the code so the read is performed through a guarded accessor and returns zero when the socket is not a locked full socket.

The vulnerability affects any Linux kernel that contains the unguarded rtt_min read in sock_ops. No specific version numbers are listed in the advisory, so any kernel prior to the patch is potentially affected.

The CVSS score is 2.3 and the EPSS score is below 1%, indicating a low severity and very low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog, suggesting no publicly known exploits at the time of the advisory. Exploitation would likely require privileged loading of a BPF sock_ops program, which lets an attacker read adjacent kernel memory and potentially pivot to further attacks. Because the bug involves a memory read rather than a control‑flow hijack, the impact is limited to information disclosure, but it still represents a notable risk to kernel confidentiality.