The vulnerability arises from the Linux kernel’s handling of GSO packets in net/tso.c and qdisc_pkt_len_segs_init. A driver that assumes headers are already present in skb->head may call skb_header_pointer, which can return a pointer to uninitialized or out‑of‑bounds memory. When the kernel copies these values, it can read beyond the packet payload or corrupt the skb. This leads to a kernel crash or memory corruption when a malicious packet is received.

Any Linux kernel implementation that has not incorporated the commit that replaces skb_header_pointer with pskb_may_pull in qdisc_pkt_len_segs_init is affected. That includes most releases prior to the fix listed in the public Git references and applies to all devices running an unpatched kernel.

The CVSS score is not supplied and EPSS is unavailable, but the vulnerability represents a serious risk to systems exposed to untrusted networks. An attacker only needs to craft a GSO packet with an incorrect header length; if the kernel accepts it, the resulting out‑of‑bounds read can crash the system. Because the code path is in the network stack, exploitation is likely to be local to remote network traffic, and the flaw is already present in production kernels until patched. The flaw has not yet entered the CISA KEV list, but its high impact suggests it could be considered for high‑priority remediation.