The vulnerability is a use‑after‑free flaw in the Linux kernel’s IP‑tunnel Maximum‑Segment‑Size discovery logic. In iptunnel_pmtud_build_icmp() and its IPv6 counterpart, the code read and cached the IP or IPv6 header before performing a socket buffer copy‑on‑write (skb_cow()). If the copy causes the buffer to reallocate, the stored header pointers become dangling, allowing a malicious packet to trigger a use‑after‑free that could lead to arbitrary kernel execution. This weakness is identified as CWE‑825.

Any Linux kernel where the vulnerable iptunnel_pmtud_build_icmp() or iptunnel_pmtud_build_icmpv6() implementation is present and the fix that re‑initializes header variables after skb_cow() has not been applied is affected. The CPE indicates all Linux kernel kernels, meaning that all currently released releases that predate the patch are at risk until the patch is installed.

With a CVSS score of 9.8 the flaw is classified as critical. The EPSS score of less than 1 % suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to involve the delivery of specially crafted tunnel packets that trigger the PMTU discovery routine, requiring network or local access to the target host. No public exploits have been reported, but the use‑after‑free nature makes it a high‑value target for adversaries seeking kernel privilege escalation.