Packets aggregated via GRO may be marked to flush, and the kernel incorrectly allows these marked packets to be re-aggregated. The flaw corrupts the frag_list chain, which SIC segmanager attempts to access and results in a null-pointer dereference and kernel panic. The primary impact is a denial of service through a system crash, affecting confidentiality, integrity, and availability.

All Linux kernel instances that lack the fix for the double aggregation of flush-marked skbs, typically kernels running the GRO and GSO path prior to the commit 0ab03f353d36, are vulnerable. This includes devices that use tethering, device forwarding, or any network interface that can receive large aggregated packets with a flush flag set.

The CVSS metric is not provided and EPSS is not available, indicating no publicly known exploitation activity. However, the attack vector is network-based and requires the malicious packet to be injected into an interface that processes GRO. Exploitation demands precise triggering of the flush flag, and success leads to an immediate kernel panic. While the likelihood of exploitation at large scales is uncertain, any device exposed to potentially untrusted traffic offers a plausible attack surface.