The kernel incorrectly reads the IPv4 fragment offset field (frag_off) from packets received via the PF_PACKET path using a direct memory dereference. Because the packet header may not be linear, this can cause the kernel to read uninitialized or invalid memory, triggering a KMSAN uninitialized‑value warning or a kernel fault. The unsafe header access may corrupt kernel memory or lead to a crash, resulting in loss of service or system instability.

All Linux kernel builds released before the commit that switches the frag_off check to skb_header_pointer(). The vulnerability affects every distribution or custom kernel running the affected kernel version, regardless of configuration.

The CVSS score of 5.5 classifies this issue as medium severity. Because there is no EPSS score or KEV listing, the exact likelihood of exploitation remains unclear. The likely attack vector would involve injecting crafted packets with the PF_PACKET socket, which usually requires CAP_NET_RAW or root privileges. An attacker with such privileges could trigger the unsafe header read, potentially causing a kernel fault and system instability.