The flaw resides in the Linux kernel’s IPTFS reassembly logic, where a non‑linear socket buffer is inadvertently appended using skb_put. This causes the SKB_LINEAR_ASSERT check to trip, producing an Oops and a kernel panic. An attacker can exploit this by fabricating IP fragments that trigger the reassembly path, forcing a system reboot or halt and disrupting availability for the affected host.

All Linux kernel installations that enable the IPTFS feature are affected. The advisory does not limit the vulnerability to a specific kernel release, but any kernel containing the vulnerable code path—such as the current stable series and upcoming releases—must be considered at risk until the patch is applied.

The EPSS score is reported as less than 1%, indicating a very low but non‑zero likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. The CVSS score of 5.5 reflects medium severity. Based on the description, it is inferred that the attack vector involves crafting IP fragments over the network, and exploitation requires network‑level access to send these fragments; no local privileges or advanced conditions are mentioned. The kernel panic is the sole observed impact, rendering the system temporarily unavailable until it is rebooted or the fault is mitigated.