A flaw in the Linux kernel’s handling of tunneled traffic caused checksum offload flags to be incorrectly applied for packets that contain IPv6 extension headers. Instead of falling back to software checksum offload and the related Generic Segmentation Offload (GSO) path, the kernel continued to advertise hardware offload support. This mismanagement could result in malformed packets being sent or received, potentially causing connectivity issues or service disruption. The weakness involved improper validation of packet header lengths during the offload decision logic, which maps to incorrect input handling and corresponds to CWE-358.

The vulnerability affects Linux kernel versions prior to the patch introducing the GSO fallback for tunneled packets. Specifically, the CPE list includes kernels 6.17 RC1 through RC7, and 7.0 RC1 through RC5, as well as any builds before 6.17. Any system running one of these kernels is susceptible.

The CVSS score of 7.5 indicates high severity. The EPSS score is 0.00053, which translates to an extremely low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector involves a remote, network‑based adversary crafting traffic that triggers the faulty GSO logic, potentially leading to packet corruption or service disruption. No exploit code or proof‑of‑concepts are documented, so the exact likelihood remains uncertain, but the kernel‑level nature of the flaw suggests a high‑impact scenario should the exploit be realized.