The Linux kernel contains a flaw in the iptunnel_pmtud_check_icmp() routine. When this function is invoked while the socket buffer’s transport header is unset, it derives an excessively large offset, leading to an out-of-bounds read of the ICMP header. The read can expose unrelated memory contents or cause a kernel panic, impacting confidentiality and availability.

All Linux kernel implementations that embed the iptunnel_pmtud_check_icmp() function without the recent bounds check patch are affected. This includes any kernel version that has not yet merged the referenced commits, across all distributions that ship the upstream kernel.

The CVSS score of 9.1 signals a high impact vulnerability. The EPSS score of <1% indicates that, to date, exploitation attempts have been rare, and the vulnerability is not catalogued in CISA’s KEV list. The likely attack vector is remote over the network: an attacker can craft an ICMP packet that triggers MTU discovery on a tunnel interface, causing the vulnerable code path to execute. The resulting out-of-bounds read is inferred to potentially leak kernel memory or crash the system, but the extent depends on the specific packet contents and kernel configuration. Local privilege escalation is not required for exploitation.