The vulnerability is an out‑of‑bounds read in the netfilter xt_tcpmss module that parses TCP options in the Linux kernel. When the TCP option’s last byte is not an end‑of‑list or NOP marker, the parser reads the next byte without checking that the remaining length is sufficient. This can cause reads past the end of the option buffer, exposing contents of the kernel stack or subsequent payload data. The weakness follows CWE‑125 and CWE‑130 and may lead to kernel memory disclosure or a denial‑of‑service via a crash.

All systems running a Linux kernel that includes the xt_tcpmss netfilter module are potentially affected, including the default distribution kernels. No specific version range is listed in the CNA data, so any unpatched kernel is at risk until the patch is applied.

The EPSS score is reported as less than 1% (approximately 0.00052), and the vulnerability is not in the CISA KEV catalog. The CVSS score is 8.2. Based on the description, it is inferred that an attacker can trigger the vulnerability by sending crafted TCP packets to the target system. Since it results in a memory read beyond the kernel buffer, the risk is considered high, especially for systems exposed to untrusted networks. The weakness is rooted in CWE‑125 and CWE‑130, indicating an unsafe assumption and an out‑of‑bounds read. No public exploits were reported at the time of this analysis, but the severity of a kernel memory leak warrants prompt action.