In the Linux kernel, the ipgre_header() function performs insufficient validation of packet header sizes when GRE tunneling data is processed. When a network team or bonding driver changes device headroom and allocates a socket buffer with too little reserve, the subsequent packet handling triggers a memory corruption that causes a kernel panic. The crash results in a complete loss of kernel operation, effectively denying all services on the affected host.

The vulnerability applies to all Linux kernel releases that include the unpatched ip_gre implementation, spanning kernel series 3.10 through the 6.19 release candidates as indicated by the vendor product list. Any distribution or environment that runs a kernel within these ranges without the patch is potentially impacted until the fix is incorporated.

The CVSS base score of 5.5 indicates moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of routine exploitation, and the issue is not listed in CISA’s KEV catalog. Exploitation requires the ability to trigger GRE packet processing on a team or bonded interface, typically through privileged network interaction or local code execution. If achieved, the attacker can bring the system down by causing a kernel panic, but the attack vector is not trivial and would likely necessitate prior access or influence over the network stack.