The vulnerability (CVE-2026-74268) in the Linux kernel TCP stack occurs when a child socket inherits the listener's BPF socket operations callback flags via sk_clone_lock(). If the child socket setup fails in tcp_v4_syn_recv_sock() or tcp_v6_syn_recv_sock(), the child is freed through put_and_exit. During forced closure, inet_csk_prepare_forced_close() drops the socket lock, but tcp_done() runs and calls tcp_set_state(), which calls tcp_call_bpf() expecting the socket lock. This leads to a kernel warning due to sock_owned_by_me() check failure. The root cause is that the child socket's callback flags are not cleared before forced closure, causing callbacks to run on a freed or unestablished socket. The fix involves clearing the callback flags in inet_csk_prepare_for_destroy_sock(), covering IPv4, IPv6, chtls forced-close paths, and MPTCP failure paths.

This vulnerability can cause kernel warnings and potentially unstable behavior due to callbacks being invoked on a child socket that was never fully established and is freed without the expected socket lock. While no direct exploit or remote code execution is indicated, the issue can lead to kernel instability or denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix has been implemented in the Linux kernel source code by clearing the child socket callback flags before forced closure. Users should monitor official Linux kernel advisories and apply updates once available.