The vulnerability resides in the Linux kernel’s GTP‑U module, where the gtp1u_send_echo_resp function ignores the return value of skb_pull_data. When the packet contains fewer than 20 bytes, skb_pull_data returns NULL without moving the skb data pointer. The function then continues to push headers, causing the skb data to fall below its head and triggering a kernel panic. This results in the entire system rebooting and all networking services being lost. The weakness is an unchecked return value leading to a null pointer dereference (CWE‑124).

Any Linux installation that includes the GTP‑U code path in the kernel is potentially affected. The CVE data does not list specific kernel versions, so the impact is understood to cover all kernels that support GTP‑U tun interfaces. This includes recent 5.x and 6.x series kernels until the patch that adds the skb_pull_data check is applied.

Exploitation requires an attacker to send a crafted 16‑ to 19‑byte GTP echo request to a target’s GTP‑U interface. The attack vector is therefore remote, via network traffic that the kernel accepts. The EPSS score is reported as < 1%, indicating a low probability of automated exploitation, but the CVSS score of 7.5 reflects a high‑severity denial of service risk. The vulnerability is not listed in the CISA KEV catalog, so there is currently no known widespread exploitation. The impact is purely disruptive with no data theft or lateral movement. The attacker would need to be able to generate or forward GTP packets to the vulnerable host.