An out‑of‑bounds memory read occurs in the kernel function qdisc_pkt_len_segs_init when it pulls packet headers for GSO packets using skb_header_pointer. The function expects headers already present in skb->head and can misread memory if a GSO packet with malformed or fabricated headers is processed. The vulnerability is a typical CWE‑131 weakness involving incorrect bounds checking. Attackers can trigger the flaw by sending specially crafted GSO packets that exploit the misread, leading to a kernel crash and a system‑wide denial of service.

All Linux kernel builds that do not yet contain the patch referenced by commit 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 are affected. This includes virtually all distributions that ship kernel versions prior to that commit, regardless of the specific release number, because the vulnerability resides in core networking code.

The vulnerability carries a CVSS score of 8.4, indicating high severity. Its EPSS score of <1% denotes a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It can be exploited remotely by sending a crafted GSO packet; no local privilege or authentication is required. If successfully triggered, the kernel crash results in a denial of service affecting the entire system.