The Linux kernel incorrectly assumes that skb packets marked as PACKET_OUTGOING are only used for error queues. When this assumption is violated, packets from AF_PACKET sockets can cause the timestamp control‑message path to read control‑buffer data that belongs to error packets. The misinterpretation may cause the kernel to emit timestamping statistics that copy beyond the linear head of the skb, triggering a hardened usercopy failure or exposing adjacent heap memory. The result can be a kernel crash or the disclosure of sensitive data.

All versions of the Linux kernel that were affected before the commit that fixed this logic flaw. The issue is present in any kernel build that predates the patch located at commit 1ee90b77b727df903033db873c7527ec98 and subsequent fixes.

The CVSS score is not provided, and the EPSS score is unavailable, so precise risk quantification is not possible. However, exploitation requires timestamping to be enabled on AF_PACKET sockets and that the attacker can craft packets that trigger the timestamp cmsg path. If triggered, the kernel may perform a hardened usercopy that can lead to a crash, or it may expose adjacent heap contents giving visibility into sensitive data. The vulnerability is local to an attacker who can influence packet sockets, such as a privileged user on the host or a remote attacker with a raw socket interface that can send crafted frames. No evidence suggests attacker could gain arbitrary code execution, but the impact could result in denial‑of‑service or information disclosure.