The vulnerability originates from nf_osf_match(), where the shared context pointer is not restored after a successful fingerprint match. When NF_OSF_LOGLEVEL_ALL is enabled, the function reuses the advanced pointer for subsequent matches, causing it to read beyond the bounds of the TCP option buffer. This out‑of‑bounds read corrupts log data and can trigger a kernel abort, resulting in service disruption or incorrect log entries. The weakness is a classic out‑of‑bounds read flaw, marked by CWE‑125.

This flaw affects the Linux kernel in all distributions, as the advisory references the generic CPE for Linux kernel and does not specifymodule. Any kernel build that includes the nfnetlink_osf component is potentially vulnerable, regardless of version.

The advisory does not provide a CVSS score or EPSS estimate, and the vulnerability is not listed in the CISA KEV catalog. The bug requires that the attacker is able to configure NF_OSF_LOGLEVEL_ALL, which typically requires local or root privileges. While there are no publicly disclosed exploits, the nature of the out‑of‑bounds privileged adversary to corrupt logs or cause a kernel panic, representing a moderate to high risk for systems that enable detailed OSF logging.