The Linux kernel incorrectly copies a socket’s PSP (Protocol Support Per-Connection) association pointer into cloned sockets without proper reference counting. When a child socket inherits the parent’s association and the parent is closed during the TIME_WAIT state, the association can be freed while still referenced, resulting in a use‑after‑free condition. This kernel memory corruption can trigger a crash or potentially allow a local attacker to execute arbitrary code with elevated privileges, as the freed memory may be reused by the kernel for sensitive data such as cryptographic keys or SPI values.

All Linux kernel builds that have not applied the fix to clear the PS association on socket clone are affected. The vulnerability’s CPE indicates a generic Linux kernel, and no specific version string is provided, so any distribution running an older kernel that still inherits the PSP association on clone is susceptible.

The CVSS score is not supplied and the EPSS score is unavailable, so the explicit likelihood of exploitation is unknown. The vulnerability is recorded as not in the CISA KEV catalog, suggesting limited exploitation to date. The attack requires the ability to create and close sockets, manipulate listener states, and observe TIME_WAIT handling, making it potentially exploitable by local users with network or elevated privileges rather than by remote attackers without kernel access. Nonetheless, the nature of a use‑after‑free in the kernel makes the risk significant for affected systems, as it can lead to denial of service or privilege escalation if exploited successfully.