The Linux kernel bug allowed a BPF sock_ops program that accessed the rtt_min field of a socket struct without validating the socket type to perform an out‑of‑bounds read. This access can pull in adjacent kernel memory, exposing kernel pointers and other sensitive information. The flaw is a classic out‑of‑bounds read (CWE‑788) that has been mitigated by patching the code so the read is performed through a guarded accessor and returns zero when the socket is not a locked full socket.

The vulnerability affects any Linux kernel that contains the unguarded rtt_min read in sock_ops. No specific version numbers are listed in the advisory, so any kernel prior to the patch is potentially affected.

The CVSS score is not reported, and the EPSS score is unavailable, so the precise likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploits at the time of the advisory. The flaw could be exploited by an attacker who can load BPF sock_ops programs, which typically requires privileged access, to read kernel memory and potentially pivot to further attacks. Because the bug involves a memory read rather than a control‑flow hijack, exploiting it may be more limited, but it still represents a significant information‑disclosure risk.