The bug, discovered in the Linux kernel's X25 networking subsystem, is an integer overflow that occurs when the kernel accumulates packet fragments. The missing bounds check on the x25_sock.fraglen field can cause the counter to wrap around, resulting in corrupted state and potentially unsafe memory handling. As a consequence an attacker could force the kernel to misinterpret packet sizes or indices, leading to memory corruption or a denial of service.

All versions of the Linux kernel that include the net/x25 module and have not yet incorporated the fix are affected. The vulnerability is present in the core kernel code and would impact any system running an unpatched kernel that enables or processes X25 traffic, irrespective of distribution vendor.

The CVSS score is not supplied, but the integer overflow is a significant vulnerability that could be exploited by an attacker with the ability to send crafted X25 packets to the target machine. The required attack vector is network‑based, and the vulnerability does not require local privileges. With the EPSS score unavailable and the issue not listed in KEV, the overall risk remains high until the patch is applied.