In the Linux kernel, the nfnetlink_osf filtering code allows a zero‑length TCP option or an MSS option shorter than four bytes to bypass bounds checking. This omission enables an attacker to craft a packet that causes an out‑of‑bounds read and a null‑pointer dereference in nf_osf_match_one, resulting in a general protection fault and a kernel panic. The crash propagates through the netfilter stack, leading to a system‑wide denial of service. The underlying weakness is in inadequate input validation (CWE‑119, CWE‑20, CWE‑476).

This vulnerability affects any system running the Linux kernel that includes the nfnetlink_osf component before the accompanying patch. The vendor is Linux (Kernel), and no specific affected version range is supplied in the data. Therefore, any kernel release that has not applied the patch is vulnerable.

The CVSS score is not provided, but the EPSS probability is less than 1 % and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Nevertheless, an attacker can remotely trigger the fault by sending crafted TCP packets with malformed options to a reachable host, making this a network‑based denial‑of‑service risk. It does not require privileged local access, so the attack path is plausible in typical environments. The attack vector is inferred from the fact that malformed packets are processed in the networking stack.