The Linux kernel implements a packet transmission path that allows user‑space applications to map a transmit ring buffer into their address space. When the PACKET_VNET_HDR feature is active, the kernel copies the virtio net header directly from this shared memory. The code first validates the header, then later re‑reads the fields when converting the packet data to a socket buffer. A concurrent user thread can modify the header between these two steps, bypassing the validation and potentially injecting crafted data or corrupting the packet format. This TOCTOU race could result in malformed packets, loss of data integrity, or other unintended kernel behavior.

All Linux kernel releases that incorporate the tpacket_snd() implementation prior to the commit that copies the vnet_hdr to a stack‑local variable. The issue is present when the PACKET_VNET_HDR option is enabled in TPACKET transmit mode.

The EPSS score for this vulnerability is not available and it is not listed in CISA’s KEV catalog, indicating the attack surface and exploitation likelihood are not well documented at this time. The CVSS score is 7.0, reflecting a moderate to high severity. Because the flaw involves a race condition on shared memory exposed to user space, it is inherently local to the system with the affected kernel; however, any user with write access to the mapped buffer could attempt the race. No specific exploit is known, but the mechanism allows subverted packet headers to bypass kernel checks.