In the Linux kernel the netfilter framework incorrectly processes packets whose fragments are unreadable, such as those created by devmem TCP. The bug causes functions like skb_copy_bits() to return negative error codes and leads the xt_u32, nfnetlink_queue, and nfnetlink_log modules to drop traffic or stall. This flaw represents an improper handling of unreadable skb fragments and is identified as CWE‑390. The result is that legitimate traffic can be dropped or the kernel can stall, impairing availability of network services.

All Linux kernel installations containing the netfilter framework, particularly those using the xt_u32, nfnetlink_queue, or nfnetlink_log modules, are affected. The vendor list indicates any Linux kernel built with the default configuration before the referenced patch is at risk. No precise version range was supplied, so all kernels prior to the applied fix are considered vulnerable.

The CVSS score of 7.5 highlights substantial severity. The EPSS score of less than 1% indicates a low likelihood of exploitation, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is an attacker crafting network packets that contain unreadable fragments; because the failure occurs at the kernel level, successful exploitation would trigger packet drops or service interruptions rather than code execution. While the probability of real‑world attacks remains low, the impact on availability is high if the defect is triggered.