The vulnerability resides in the Linux kernel’s netfilter flowtable module where attempts to offload IPIP tunnel processing onto hardware are not yet supported. When configuration attempts are made, the stub logic enqueues the offload job but then silently discards it if the hardware cannot handle the request, setting a flag to avoid repeated retries. This behavior does not trigger crashes, privilege escalation, or data leakage; it merely ensures that unsupported offload attempts do not repeatedly consume resources. The impact is limited to the operational path of IPIP tunnels and they will fall back to software handling, which may affect throughput but does not compromise confidentiality, integrity or availability beyond performance considerations. The likely attack vector is kernel‑level configuration by a privileged user; no remote exploit is documented.

All Linux kernel releases that include the netfilter flowtable module with the IPIP tunnel offload stub are affected. The specific kernel version range is not disclosed in the advisory; any current kernel that uses this stub path is potentially impacted. Users should examine their kernel sources or release notes to determine if the flowtable IPIP offload logic is present and whether it has been updated.

The CVSS score is 9.8, illustrating that the flaw is considered high severity, but the EPSS score of less than 1% indicates a very low probability that the vulnerability will be exploited in the wild. The vulnerability does not appear in the CISA KEV catalog, and there are no public exploits or reports of malicious use. Because the flaw requires kernel‑level manipulation of offload settings—a privilege that is typically reserved for system administrators—the risk to the broader population remains low, but it can still degrade performance for affected networks.