The vulnerability is triggered when a BPF stream_verdict program redirects a socket buffer back to the same socket with the BPF_F_INGRESS flag. In this flow the kernel increments the TCP socket’s copied_seq counter twice – once by the redirection handler and once again when the packet is processed by the TCP receive logic. The resulting double‑counting causes the copied_seq value to advance by two times the actual data length, which leads to incorrect TCP sequence bookkeeping, warning messages in the kernel log, and potential inconsistency or loss of data for user space readers.

The flaw exists in the Linux kernel source code. Any host running a kernel that includes the standard BPF and sockmap modules is affected. The issue manifests whenever a self‑redirect is performed via a BPF program; cross‑socket redirects are unaffected. Consequently, all brand‑new or legacy Linux kernel builds that have not been patched will contain this code path.

The EPSS score for the vulnerability is less than 1 % and the CVSS score is 4.4. It is not listed in the CISA KEV catalog and no public exploits are known. Exploitation would require an attacker to run a privileged BPF program capable of issuing a self‑redirect, which is normally limited to users with elevated kernel privileges or module developers. While the risk of successful exploitation is low, the data integrity impact justifies timely remediation.