The bug originates from incorrect handling of the socket option SO_RESERVE_MEM in the Linux kernel. The option was originally supported for both TCP and UDP sockets, but its implementation only protected internal accounting for TCP, leading to a race condition when UDP sockets performed packet reception and release concurrently with setsockopt(SO_RESERVE_MEM). This corrupts internal socket memory structures. In addition, the kernel did not enforce an upper bound on the value passed to SO_RESERVE_MEM; passing a value larger than one gigabyte caused arithmetic overflows in page calculations, further corrupting socket memory fields. From the description it is inferred that a local attacker who can create a UDP socket and use setsockopt(SO_RESERVE_MEM) with large values could trigger the race and overflow, potentially leading to kernel memory corruption, crash, denial of service, or privilege escalation.

The vulnerability affects Linux kernel implementations that have not yet incorporated the patch. The commits that introduced the fix (2bb2f5fb21b0 and d00c8ee31729) were applied to the mainline kernel, but no specific kernel version numbers are listed. Therefore, any Linux kernel release that predates these commits and still allows SO_RESERVE_MEM on UDP sockets or accepts values larger than one gigabyte is potentially affected.

The kernel memory corruption gives the vulnerability a moderate to high risk rating. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so publicly confirmed exploits have not been reported. Nevertheless, because the bug can be triggered by local code that manipulates UDP sockets, an attacker could cause kernel instability, denial of service, or even privilege escalation by exploiting the corrupted state. The applied patch restricts the socket option to TCP sockets and caps the maximum value, directly mitigating the corruption risk.