In the Linux kernel, a flaw was discovered in the Generic Receive Offload (GRO) handling routine where the function skb_gro_receive_list() pulls data from a socket buffer without first verifying that the data resides in the linear part of the buffer. When packets arrive through napi_gro_frags() with all data in page fragments and a non‑zero GRO offset, the incorrectly pulled data triggers a BUG_ON in __skb_pull(), resulting in an immediate kernel panic. The impact is a denial of service that aborts the operating system when the vulnerability is exercised. The weakness is a precondition check failure related to improper buffer bounds handling and aligns with CWE‑125 (Out‑of‑Bounds Read).

All Linux kernel implementations across distributions are affected, regardless of vendor, as the issue is in core kernel networking code. The problem exists wherever the kernel runs segmented packet processing via GRO, which is common in modern network stacks.

The absence of EPSS data and that it is not listed in KEV means the exploit probability is not quantified, but the failure leads to a system crash whenever malicious or malformed packets are processed. Given the critical nature of the kernel and the ease of delivering network traffic, the risk is considered high. The vulnerability can be triggered remotely by crafted packets and does not require elevated privileges on the host. No public exploit code is known, but the nature of the bug allows for straightforward exploitation in environments that process network traffic.