The Linux kernel contains a flaw in the traffic control module where the copy‑on‑write (COW) range for writable packet buffers is calculated before the actual key offsets are known. When a packet manipulation action uses an offset that is not fully COW’ed, writing to the buffer corrupts the page cache. This type of corruption can overwrite kernel memory, potentially leading to data integrity errors or privilege escalation. The weakness is a classic out‑of‑bounds write.

All versions of the Linux kernel prior to the inclusion of the commit that implements the fix (identified in the reference link) are affected. The fix appears in the latest stable kernel release as of the time of this advisory. Systems should evaluate whether their kernel build incorporates this commit.

The CVSS score is not provided, but the extremely low EPSS (< 1%) suggests a modest likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying it has not been observed in the wild to date. The attack vector is inferred to be local or privileged, requiring the attacker to inject or manipulate network packets to trigger the packet editing path. An exploitation chain would involve crafting a packet so that the pedit action writes outside the COW region, thereby corrupting the kernel’s page cache.