In the Linux kernel’s networking stack, writes to the sysctl net.ipv4.tcp_reordering are stored as a signed int but later copied into an unsigned 32‑bit field that controls TCP packet reordering. A negative write wraps to a large unsigned value. When tcp_mtu_probing is set to level 2, that wrapped value is used in a size calculation within tcp_mtu_probe(); the calculation can overflow, causing the routine to perform an out‑of‑bounds read. This failure can lead to a kernel panic or loss of service, exposing the kernel to a denial‑of‑service condition.

The flaw exists in the Linux kernel; any distribution that runs a kernel version prior to the commit that introduces the defensive checks is affected. Because the vulnerable code is part of the core networking subsystem, the issue applies to all network namespaces on the system. No specific release numbers are supplied, so systems with a kernel lacking the patch are considered vulnerable.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting low observed exploitation activity. Based on the description, it is inferred that the attacker requires local privilege or the ability to write to system sysctl values. Once the offending sysctl write is performed, the resulting overflow can trigger the out‑of‑bounds read in the MTU probing path, causing a kernel crash or service disruption. Because no remote network interaction is required, the attack surface is limited to systems where privileged users can modify sysctl parameters.