The vulnerability resides in the ice driver’s handling of the XDP Receive Queue frag_size field. The field was incorrectly set to the DMA write length rather than the full XDP frame size, causing the helper bpf_xdp_frags_increase_tail() to compute an incorrect tailroom size. When an XDP program uses the XDP_ADJUST_TAIL_GROW_MULTI_BUFF operation with an oversized packet size and a very large offset, the driver attempts to grow the tailroom based on a negative value, triggering a kernel panic. This flaw is classified as a classic integer overflow/underflow (CWE‑131) and results in a system‑wide denial of service. The patch replaces frag_size with the true queue buffer size and also fixes zero‑copy mode.

This issue affects all Linux kernel releases that ship the unpatched ice network driver. The ice driver is used for Intel Ethernet controllers in the Linux kernel. No specific kernel version range is provided in the advisory, so any kernel that has not yet incorporated the change to compute frag_size correctly may be vulnerable. Vendors that distribute kernels containing the legacy ice driver need to ensure the fix is included before exposing the kernel to user‑programmed XDP logic.

The CVSS score of 7.0 denotes medium severity. The EPSS value is under 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a relatively low probability of mass exploitation. Nonetheless, the flaw requires an attacker to induce a specially crafted XDP packet path that invokes the problematic tail‑growth operation. Such a scenario is feasible only on systems that allow custom XDP programs on the ice driver, so while exploitation is possible, it may be limited to targeted or privileged environments.