The vulnerability originates in the Linux kernel’s handling of hardware packet parsing during transmission. When the hardware receives a packet with incomplete or malformed IPv4, IPv6, TCP, or UDP headers, it mistakenly expects additional data that is not present. This mismatch can trigger a transmit (TX) hang, effectively blocking the networking stack and causing a denial of service. The flaw is in the driver’s lack of proper bounds checking and handling for fragmented packets and packets destined for hardware PTP parsing, leading the hardware parser to overread packet data. The impact is a local or remote DoS that can be triggered by sending specially crafted packets to the host, as the hardware will lock up in a TX state until it times out or is reset.

Affected systems include all Linux kernel users that have not applied the rtase TX hang workaround. Vendors noted are generic Linux distributions, covering any kernel image before the patch that drops malformed packets and pads transport data for fragments and PTP‑eligible packets. No specific version information is listed, so any kernel not containing the recent rtase changes is potentially vulnerable.

The exploit can be performed remotely by inserting crafted network traffic on any interface that forwards packets to the hardware device. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly confirmed exploitation. The CVSS score is not provided, but the nature of a TX hang suggests a high severity DoS risk. The attacker must be able to send packets that the kernel forwards to the hardware, which is typical for network-facing hosts. The lack of a published public exploit does not diminish the risk; a motivated actor could easily replicate the conditions described by the kernel maintainers.