The flaw resides in the Linux kernel GTP‑U implementation. The gtp1u_send_echo_resp function ignores the return value of skb_pull_data, which may return NULL if the packet does not contain at least 20 bytes. When a 16‑19‑byte echo request arrives, the pull fails, but the code continues to push headers, moving the socket buffer beyond its head pointer. This triggers a kernel panic, causing the system to reboot and disabling all networking services on that host. The weakness can be described as an unchecked return value leading to a null pointer dereference (CWE‑690).

Any Linux installation with a kernel that includes the unpatched GTP‑U code is susceptible. The CVE report does not list specific kernel versions, but the issue existed in the code path that was later identified in the patch. In practice, all Linux kernels that support GTP‑U tun interfaces, such as those used in 5.x and 6.x series, would be affected until the stated fix is applied.

Exploitation requires remote access to a GTP‑U interface, which is typically reachable over a trusted IP or VPN. An attacker can craft a 16‑19‑byte GTP echo request to trigger the bug. Because the outcome is a kernel panic, the impact is total denial of service with no lateral movement or data exfiltration. The EPSS score is not available, but the kernel‑panic severity translates to a high CVSS score likely above 8.0. The flaw is not yet listed in the CISA KEV catalog, but given its potential for widespread impact it should be treated as a high‑risk condition.