CVE-2024-50154 is a use-after-free vulnerability in the Linux kernel's TCP/DCCP subsystem related to improper handling of timer_pending() in reqsk_queue_unlink(). This flaw can cause a timer to continue running after the associated socket has been closed, potentially leading to use-after-free conditions when BPF programs access freed memory. The issue arises from a race condition introduced by a recent fix that missed calling del_timer_sync() in some cases. The vulnerability has been resolved by avoiding the use of timer_pending() in this context.