The vulnerability originates from an uncontrolled access to the icsk_ca_ops->name field in the Linux kernel’s TCP GETSOCKOPT handler when no read lock is held. This race allows a user to free the underlying BPF structure concurrently via TCP_CONGESTION setsockopt, producing a use‑after‑free and a KASAN crash. An attacker who can trigger this sequence could run arbitrary code at kernel privilege level.

The flaw exists in the Linux kernel for all distributions that compile the network stack with support for BPF based congestion control helpers, prior to the patch. No specific version was listed, so any kernel lacking the commit that protects ca_ops->name is potentially affected.

Because the flaw involves a kernel data‑structure race, it requires local code execution or privileged access to trigger. The EPSS score is unavailable and the vulnerability has not yet appeared in the CISA KEV catalog, but the severity of a kernel use‑after‑free is high. The likely attack vector is a local module or user‑space program that invokes setsockopt(TCP_CONGESTION) while a socket is being queried for its congestion control name under do_tcp_getsockopt.