A crafted IPv4 packet with an Internet Header Length of less than five can be injected via a raw socket that uses the IP_HDRINCL option in the Linux kernel. The kernel's validation incorrectly permits such packets and forwards them into the IP output path where downstream code, such as the authentication header module, assumes a sane IHL and performs an out‑of‑bounds memory copy. This out‑of‑bounds write is a classic example of CWE‑805: Buffer Access with Incorrect Length Value. The resulting kernel panic brings the host down, causing a complete denial of service.

All Linux kernel implementations that have not yet incorporated the commit that adds a check for IHL values less than five are affected. This includes kernel releases across both Linux distributions listed in the CNA data prior to the application of the identified patch. No specific version numbers are provided, so all kernels lacking the mitigation should be considered vulnerable.

The vulnerability carries a CVSS score of 7.8 and an EPSS score of less than 1 %, and it is not listed in CISA’s KEV catalog. Exploitation requires a process with CAP_NET_RAW capability; in user and network namespaces an attacker may use CAP_NET_ADMIN to install the necessary raw‑socket permissions. An attacker who can craft a packet with IHL = 4 can trigger a local kernel crash. While the attack vector is relatively narrow and the probability of exploitation is low, the impact—a full kernel crash—renders the vulnerability a severe denial‑of‑service vector.