The Linux kernel has a flaw that allows the condition rescheduling function (cond_resched) to be called while the kernel is in a read‑side RCU context during BPF socket cleanup. When a BPF program iterates over listening sockets that still have pending accepts, the socket destruction path can trigger this invalid scheduling call, which causes the kernel to trip a BUG and crash. The result is a loss of availability for the entire system, as the kernel panics and the host must be rebooted.

The issue affects the Linux kernel itself; any distribution using a kernel that contains the unpatched implementation of inet_csk_listen_stop in a BPF context is vulnerable. The known affected CPE covers the generic linux_kernel identifier, implying the vulnerability spans all kernel releases prior to the patch commit. No specific version numbers were provided in the advisory, so all kernels that have not applied the fix should be considered affected.

Risk is moderate to high because the bug results in a kernel panic, which is a critical denial of service. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, suggesting that widespread exploitation has not been documented. However, the attack mechanism requires the attacker to execute BPF code or create socket states that trigger the listener path; such capabilities are typically available to local users with sufficient privileges, meaning the threat could be mitigated by restricting BPF program loading or by applying a patch. Without a patch, an attacker could cause any process on the host to be unable to start or manage network sockets, effectively disrupting network services.