The vulnerability originates in the netfilter x_tables option walkers used for TCP, UDP, and DCCP packets. Walkers that increment the option index with i += op[i + 1] ?: 1 can read the following byte (op[i + 1]) even when the current byte is the last in the option area, allowing a one‑byte out‑of‑bounds read. This can expose kernel memory contents or trigger a kernel crash due to a corrupted packet structure. The primary consequence is information disclosure and potential denial of service; based on the description, the flaw is exposed through crafted packets containing these options.

All Linux kernel systems that include the netfilter x_tables modules prior to the patch. No specific version range is listed, so the vulnerability applies to all kernels until the commits referenced in the advisory are applied.

The likely attack surface is network traffic, where an attacker can send crafted packets containing non‑single‑byte option kinds to a vulnerable host. The CVSS score of 8.2 indicates a high severity. The EPSS score is less than 1%, indicating a very low exploitation probability. The flaw is not listed in CISA KEV, and no public exploits are known. Nonetheless, the low EPSS should not give false reassurance; the vulnerability can lead to kernel memory exposure or a crash.