The Linux kernel’s flow dissector incorrectly assumes that PPPoE frames are uncompressed when in fact they may use Protocol Field Compression (PFC). When a compressed one‑byte protocol field is encountered, the payload shifts one byte, causing a 4‑byte misalignment in the network header. On architectures that do not support unaligned accesses, this misalignment triggers an unaligned access exception, resulting in a kernel crash and a denial of service. The flaw is a pure logic error that does not expose sensitive data or allow arbitrary code execution, but it can be exploited to render a host inoperable.

Any system running a Linux kernel with the flow_dissector implementation is potentially affected. The issue has been demonstrated on a MIPS board and would affect any architecture that enables RPS on an Ethernet interface receiving PPPoE traffic. No specific kernel version range is provided in the CVE data, so all current kernels that include the unpatched code may be vulnerable.

Because the flaw is triggered by a crafted PPPoE PFC frame, an attacker needs only the ability to send such traffic to the target’s Ethernet interface; no authentication or privileged access is required. The CVSS score is not supplied, and the EPSS score is unavailable, so it is unclear how frequently attackers have exploited this bug. The vulnerability is not listed in CISA’s KEV catalog. The impact is a disruptive denial of service that can be mitigated by applying the upstream kernel patch that disables processing of PPPoE PFC frames. Until a patch is available, a temporary mitigation is to avoid receiving PPPoE traffic on the affected interfaces.