The vulnerability is an out‑of‑bounds read in the netfilter xt_tcpmss module that parses TCP options in the Linux kernel. When the TCP option’s last byte is not an end‑of‑list or NOP marker, the parser reads the next byte without checking that the remaining length is sufficient. This can cause reads past the end of the option buffer, exposing contents of the kernel stack or subsequent payload data. The weakness follows CWE‑125: Out‑of‑bounds Read and may lead to kernel memory disclosure or a denial‑of‑service via a crash.

All systems running a Linux kernel that includes the xt_tcpmss netfilter module are potentially affected, including the default distribution kernels. No specific version range is listed in the CNA data, so any unpatched kernel is at risk until the patch is applied.

The EPSS score is not available and the vulnerability is not in the CISA KEV catalog. The vulnerability can be triggered by an attacker who can send crafted TCP packets to the target system. Since it results in a memory read beyond the kernel buffer, the risk is considered high, especially for systems exposed to untrusted networks. No public exploits were reported at the time of this analysis, but the severity of a kernel memory leak warrants prompt action.