The Linux kernel’s networking scheduler contains a flaw in the act_csum action where tcf_csum_act walks nested VLAN headers directly from skb->data. The code reads the VLAN encapsulation protocol and pulls a VLAN header length without first ensuring that the complete header resides in the linear part of the socket buffer. If only part of an inner VLAN header is linearized, this out‑of‑bounds read and subsequent skb_pull can corrupt kernel memory or violate skb invariants, leading to a crash or memory corruption. The weakness is identified as CWE-1285, an unsafe read that can be exploited to cause a denial of service.

The vulnerability applies to the Linux kernel on any system that has not yet incorporated the regression fix. No specific kernel version range is listed in the advisory; affected systems are those using a kernel that remains before the commit adding pskb_may_pull checks for VLAN headers. Administrators should verify whether their running kernel includes the changes referenced in the provided Git commit links.

The CVSS score is 5.5, indicating a medium severity that can lead to system disruption. The EPSS score is below 1%, suggesting a low probability of exploitation, and the issue is not yet cataloged in CISA's KEV list. Likely attack vectors involve an attacker transmitting specially crafted packets with nested VLAN headers to a vulnerable host's networking stack. While the exploitation scenario requires network-level access or a packet injection path, the impact remains significant because it can permanently crash the host if not patched.