It manifests when the sch_netem packet corruption routine selects a random index based on skb_headlen(skb). For fully non‑linear packets sent via an AF_PACKET TX_RING over an IPIP tunnel, skb_headlen evaluates to zero. Passing zero to the random function then yields an unconstrained 32‑bit value, which is used as an offset into skb->data, resulting in an out‑of‑bounds memory access. This can lead to a kernel panic or corruption of kernel memory.

All Linux kernel builds where the netem packet corruption feature is enabled are affected, regardless of distribution or vendor, as the CNAs list only Linux:Linux. No specific version banner is provided, so the issue may exist in any kernel containing the referenced code path.

The CVSS score of 7.8 indicates a high severity. An EPSS score of <1% implies a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, reducing immediate threat visibility. Exploitation requires an attacker to send crafted non‑linear packets to a host with the netem packet corruption logic active, likely from a position that can influence the packet stream. Successful exploitation could crash the kernel or corrupt memory, leading to denial of service.