The vulnerability manifests when the sch_netem packet corruption routine selects a random index based on skb_headlen(skb). When a fully non‑linear packet is transmitted via an AF_PACKET TX_RING over an IPIP tunnel, skb_headlen is zero. Passing zero to the random function yields an unconstrained 32‑bit value, which is then used as an offset into skb->data, causing an out‑of-bounds memory access. This corruption can lead to a kernel panic or, in the worst case, adverse memory state that could be leveraged for privilege escalation.

All Linux kernel builds where the netem packet corruption feature is enabled are affected, regardless of distribution or vendor, as the CNAs list only Linux:Linux. No specific version banner is provided, so the issue may exist in any kernel containing the referenced code path.

The CVSS score of 7.8 indicates a high severity. An EPSS score of <1% implies a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, reducing immediate threat visibility. Exploitation requires an attacker to send crafted non‑linear packets to a host with the netem packet corruption logic active, likely from a local or network position that can influence the packet stream. Successful exploitation could crash the kernel or corrupt memory, leading to denial of service or potential privilege escalation if the attacker can control the random offset further.