The vulnerability originates in the netfilter x_tables option walkers used for TCP, UDP, and DCCP packets. Walkers that increment the option index with i += op[i + 1] ?: 1 can read the following byte (op[i + 1]) even when the current byte is the last in the option area, allowing a one‑byte out‑of‑bounds read. This can expose kernel memory contents or trigger a kernel crash due to a corrupted packet structure. The primary consequence is information disclosure and potential denial of service. Based on the description, it is inferred that the flaw is exposed through crafted packets containing these options.

All Linux kernel systems that include the netfilter x_tables modules prior to the patch. No specific version range is listed, so the vulnerability applies to all kernels until the commits referenced in the advisory are applied.

Based on the description, it is inferred that the attack surface is network traffic, where an attacker can send crafted packets containing non‑single‑byte option kinds to a vulnerable host. The CVSS score of 7.0 indicates a high severity. The EPSS score of 0.00024 (0.024%) reflects a very low exploitation probability in broad data, yet the actual risk remains significant because the condition is easily satisfied by crafted traffic. The flaw is not listed in CISA KEV, and no public exploits are known. Nevertheless, the low EPSS should not give false reassurance; the vulnerability can lead to kernel memory exposure or a crash.