In the Linux kernel, the nfnetlink_osf fingerprinting subsystem fails to validate the length of individual TCP option entries. A zero‑length option or an MSS option shorter than four bytes bypasses the expected checks, causing nf_osf_match_one to dereference a null or out‑of‑bounds pointer during packet matching. This leads to a kernel general protection fault and a KASAN null‑ptr dereference, resulting in a system crash. The bug does not provide direct code execution or privilege escalation, but the crash can be triggered remotely by sending crafted packets, resulting in denial of service for the affected host.

Any Linux system running a kernel that includes the nfnetlink_osf driver but lacks the patch is affected. The affected products are Linux kernel releases compiled with nfnetlink_osf enabled. The list of affected kernel versions is not explicitly provided, so any kernel prior to the fix should be considered vulnerable.

The CVSS score is 7.1, indicating a high severity. The EPSS score is below 1 %, showing a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to send specially crafted packets to a host that processes nfnetlink_osf fingerprints, which is typically part of the netfilter packet filtering subsystem. While the immediate impact is a denial of service, there is no evidence of arbitrary code execution or privilege escalation.