The Linux kernel phonet subsystem contained a vulnerability where pn_socket_autobind() would call pn_socket_bind() with port 0 and, upon receiving an -EINVAL error, assert that the socket port was non-zero. However, pn_socket_bind() can return -EINVAL when the socket state is not TCP_CLOSE even if the socket was never bound and the port remains zero. This causes the BUG_ON() macro to fire, resulting in a kernel panic. The fix changes the behavior to propagate the -EINVAL error normally instead of panicking, preventing user-triggered kernel crashes.

This vulnerability leads to a denial of service condition by causing a kernel panic when a user triggers the specific socket bind scenario. There is no impact on confidentiality or integrity, only availability is affected due to the kernel crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid triggering the pn_socket_autobind() function with conditions that cause pn_socket_bind() to return -EINVAL in non-TCP_CLOSE socket states to prevent kernel panics.