The flaw lies in the Linux kernel’s network packet aggregation routine skb_gro_receive, which copies fragments from a source socket buffer into a GRO socket buffer without verifying whether either buffer uses zero‑copy mode. The SKBFL_MANAGED_FRAG_REFS flag marks a buffer as zero‑copy, meaning its fragment pages are not reference counted. When the routine appends these non‑reference‑counted fragments to another buffer, a dangling reference can arise, resulting in a use‑after‑free that corrupts kernel memory. This corruption could affect critical kernel data structures and lead to instability or arbitrary code execution at the kernel level.

All Linux kernel releases that lack commit 1f9c82856, including kernels 7.1 rc1 through rc4 and any other pre‑fixed versions. Systems that run those kernels and process network traffic on interfaces enabled for Generic Receive Offload are susceptible.

The vulnerability earned a CVSS score of 7.8, indicating high severity, while its EPSS score is under 1%, suggesting a low likelihood of exploitation in the wild. The flaw is not catalogued in CISA’s KEV. The likely attack vector involves an attacker sending specially crafted network packets that trigger the flawed skb_gro_receive path. Exploitation would require network connectivity to the target and would result in kernel memory corruption that could cause a denial of service or provide an escalation path if the attacker can influence the corrupted memory.