A flaw in the Linux kernel’s BPF socket handling allows an invalid call to the scheduling helper cond_resched() while a reader-side RCU context is active. When a BPF program iterates over listening sockets that still have queued accepts, the socket abort path can trigger inet_csk_listen_stop() and invoke cond_resched() in a context that does not allow sleep, producing a BUG and a kernel panic. The CWE class of this weakness is improper control flow handling in critical kernel code.

The issue affects all Linux kernels that include the unpatched inet_csk_listen_stop implementation when used from BPF contexts. All distributions shipping kernel versions prior to the patch commit are vulnerable; the advisory does not list specific version numbers, so any kernel that has not incorporated the fix should be considered at risk.

The CVSS score of 4.4 indicates a moderate severity, but the EPSS score is below 1%, and the vulnerability is not listed in CISA KEV, suggesting limited exploitation activity. The likely attack vector requires an attacker to run arbitrary BPF code or otherwise create a listener socket with pending children during BPF iteration; this typically requires local privileges or the ability to load BPF programs, which may be restricted in many environments. If exploited, the kernel panic results in a complete loss of availability for the machine, forcing a reboot or other recovery.