A security flaw in the Linux kernel traffic control subsystem allows unbounded recursion when a mirred blockcast rule is applied. The recursion counter is not incremented for blockcast paths, bypassing the intended limit and causing the kernel stack to overflow. This overflow results in a kernel panic, bringing the affected system offline.

All Linux kernel deployments that have not applied the patch, regardless of distribution, are affected. Any version of the kernel that contains the unpatched act_mirred logic can be impacted, since the issue exists whenever a mirred blockcast rule can be configured.

The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation. The CVSS score of 7.0 reflects medium severity, indicating that a successful exploit could lead to resource exhaustion and a system crash. The attack requires an unprivileged user to create a new user and network namespace (CLONE_NEWUSER | CLONE_NEWNET) and then configure traffic control with a shared mirred blockcast rule. Once configured, normal network traffic can trigger the endless recursion loop, eventually exhausting the kernel stack and causing a crash. The primary impact is availability, as the kernel panic forces the host to reboot or remain inoperable.