The vulnerability originates from the BPF devmap feature in the Linux kernel, where cloning XDP packets that are fragmented can lead to an out-of-bounds memory read. When a fragmented packet is cloned, only the linear portion of the frame is copied. The fragment metadata, which resides outside the linear area, remains uninitialized. As a result, the XDP_FLAGS_HAS_FRAGS flag is set without a valid fragment header. When the packet buffer is later freed, the kernel can misinterpret the stale tail data as a fragment header, causing an out-of-bounds access in the kernel memory.

All Linux kernel versions that lack the commit adding the check to reject fragmented frames in dev_map_enqueue_clone() and dev_map_redirect_clone(). Distribution kernels built from source older than the fix are vulnerable, while newer kernels that include the patch are safe.

The CVSS score of 9.8 indicates a severe vulnerability. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, which together suggest a low likelihood of public exploitation. From the description, exploiting the flaw would require the presence of an XDP program that performs devmap broadcast cloning and the ability to supply fragmented packets to that program. The attack vector is therefore local or requires elevated privileges to load the vulnerable XDP program. If successfully triggered, the out-of-bounds memory access could corrupt kernel memory.