In the Linux kernel ice driver, a flaw allowed the raw packet length (pkt_len) to be used without verifying it was within the allowed maximum. This omission could lead to a buffer overrun when processing a forged packet, potentially corrupting memory or causing a kernel crash. The issue was identified and fixed by adding a bounds check against VIRTCHNL_MAX_SIZE_RAW_PACKET, addressing the improper input validation identified as CWE‑20. While the CVSS score of 5.5 classifies the vulnerability as moderate, the impacted behavior is consistent with a denial‑of‑service scenario.

The vulnerability affects the Linux operating system, specifically the ice network driver integrated into the kernel. Vendor information lists the kernel as "Linux". No specific kernel version range is provided in the data, so any release containing the ice driver prior to the fix may be at risk. Users should verify if their deployed kernel includes the patch that performs the length check.

The CVSS score indicates a moderate risk, and the EPSS score of less than 1% suggests a low probability of current exploitation. The advisory notes that the vulnerability is not in the CISA KEV catalog. The likely attack vector is locally via a crafted packet sent to the NIC; while the description does not confirm remote code execution, the improper validation could lead to crashes, so comprehensive monitoring of the interface is advised until the patch is applied.