The Linux kernel misinterprets transmission return codes from virtual interfaces that do not use a queuing discipline when Generic Segmentation Offload (GSO) frames are transmitted. When a single segment of a GSO super frame fails, the kernel records the failure as if the entire frame failed, causing the TCP send buffer to remain stuck and the connection to never progress. This results in a denial of service and can effectively halt network traffic or a long‑running application using that connection. The faulty handling of return codes is a classic example of CWE-544 and is also annotated with NVD-CWE-noinfo.

All recent Linux kernels that use the standard networking stack are affected, especially when traffic passes through veth or similar virtual devices that lack a qdisc. The issue does not have a version list in the advisory, so all builds until the patch are vulnerable. Systems employing container or virtual networking that defaults to no qdisc are most likely to experience the problem.

The CVSS score of 7.5 indicates high severity, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score of < 1% indicates a very low probability of exploitation. Based on the description, it is inferred that exploitation requires an attacker to generate traffic that triggers GSO on a qdisc‑less interface, which can be done from within the same host or from a remote machine if the interface is exposed. The design flaw is internal to the kernel, but an able adversary could force a persistent TCP stall on target links, causing denial of service to users or services depending on those connections.