A use‑after‑free flaw exists in the TCP stack’s getsockopt handler for congestion‑control information. The handler accesses a function pointer in the socket’s congestion‑control operations without holding an RCU read lock, allowing concurrent freeing of that memory and resulting in a stale pointer dereference. This kernel memory corruption can enable an attacker to execute arbitrary code at ring‑0, effectively allowing privilege escalation on the affected system.

This vulnerability affects all Linux kernel releases that contain the unpatched TCP get_sockopt path. The exact version range is not specified in the advisory, but any kernel lacking the recent patch for TCP_CC_INFO is potentially vulnerable. The issue applies to generic Linux distributions and free‑software kernels that include the standard TCP implementation.

Based on the description, it is inferred that the exploit requires local access to load a malicious BPF program that uses a struct_ops congestion‑control object, or physical tampering with the kernel’s TCP structure. While the EPSS score is not available and the vulnerability is not listed in the KEV catalog, the nature of a use‑after‑free in kernel space is severe. If exploited, an attacker could gain root privileges. In the absence of a public exploit, the likelihood is uncertain, but the potential impact is high.