The vulnerability in the Linux kernel affects the BPF sockmap code path, specifically in the sk_psock_msg_verdict() function. The function takes a socket reference for psock->sk_redir, but tcp_bpf_send_verdict() copies this pointer without taking a reference before dropping the socket lock. Concurrent sendmsg() calls on the same source socket can cause the cached verdict reference to be released while another thread still uses the raw pointer, leading to a use-after-free condition. KASAN detected this slab-use-after-free during tcp_bpf_sendmsg_redir execution. The patch fixes this by taking a temporary socket reference while the source socket lock protects psock->sk_redir and releasing it only after tcp_bpf_sendmsg_redir returns, ensuring safe concurrent use.

This vulnerability can lead to a use-after-free condition in the Linux kernel, potentially causing kernel crashes or memory corruption. However, no known exploits in the wild have been reported. The impact is limited to kernel stability and security in environments using BPF sockmap features.

A fix has been applied to the Linux kernel to address this use-after-free vulnerability by properly managing socket references and locking. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the specific patched versions and apply them accordingly.