The Linux kernel’s flow dissector incorrectly assumes that PPPoE frames are uncompressed when they may use Protocol Field Compression (PFC). When a compressed one‑byte protocol field is encountered, the PPP payload shifts one byte, causing a 4‑byte misalignment in the network header. On architectures that do not support unaligned accesses, this misalignment triggers an unaligned access exception, resulting in a kernel crash and a denial of service. The flaw is a pure logic error that does not expose sensitive data or allow arbitrary code execution, but it can be exploited to render a host inoperable.

Any system running a Linux kernel that includes the current flow_dissector implementation is potentially affected. The vulnerability was demonstrated on a MIPS board with Receive Packet Steering (RPS) enabled; any architecture that enables RPS on an Ethernet interface receiving PPPoE traffic that may contain PFC frames could also be impacted. All kernel versions prior to the fix are susceptible because the unpatched code remains present.

The flaw can be triggered by sending a crafted PPPoE PFC frame to the target’s Ethernet interface, requiring no authentication or privileged access. The CVSS score is 7.5, while the EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The impact is a disruptive denial of service that can be mitigated by applying the upstream kernel patch that disables processing of PPPoE PFC frames. Until a patch is available, a temporary mitigation is to avoid receiving PPPoE traffic on the affected interfaces.