The Linux kernel incorrectly handled the socket option SO_RESERVE_MEM on UDP sockets, leading to a race condition where concurrent packet reception and set‑options could corrupt internal memory structures. Additionally, the option accepted values larger than one gigabyte without bounds, which caused arithmetic overflows in page calculations and further corrupted socket state. The result is kernel memory corruption that could trigger kernel crashes, denial of service, or potentially elevate privileges if an attacker can influence system kernel memory.

The flaw exists in all Linux kernel implementations that have not yet incorporated the 2bb2f5fb21b0 and d00c8ee31729 commits. It is not bound to a particular kernel release number, so any kernel version released before these changes that still exposes SO_RESERVE_MEM on UDP sockets or allows values exceeding one gigabyte remains vulnerable.

The CVSS score of 5.5 reflects a moderate severity; the EPSS score is less than 1%, indicating a low probability of widespread exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker requires local execution privileges and that the attack vector is local. The attacker could craft a UDP socket and set SO_RESERVE_MEM to a large value or trigger the race, leading to kernel instability or denial of service.