The vulnerability in the Linux kernel tcp_v6_syn_recv_sock() function arises because code executing after tcp_v4_syn_recv_sock() runs too late, allowing the child socket to be visible in the TCP ehash table while still referencing the listener's ipv6_pinfo, which can cause unsafe behavior. The fix moves the problematic initialization code to tcp_v6_mapped_child_init() and calls it before the ehash insertion, eliminating the race condition. This issue was discovered by syzbot and affects Red Hat Enterprise Linux 10 and related variants. Red Hat has issued security advisories (RHSA-2026:30129 and RHSA-2026:33215) providing kernel updates that address this and other vulnerabilities.

Successful exploitation of this race condition could lead to memory corruption or other unsafe kernel behavior, potentially resulting in system instability or privilege escalation. The CVSS vector indicates network attack vector with no privileges or user interaction required, and high impact on confidentiality, integrity, and availability, marking it as critical. However, there are no known exploits in the wild at this time.

Red Hat has released official kernel updates for Red Hat Enterprise Linux 10 and its Extended Update Support versions that fix this vulnerability. Applying these updates and rebooting the system is required to remediate the issue. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to apply the patches. No additional mitigation steps are indicated beyond applying the official fix.