The Linux kernel GRE tunnel code suffers from CWE‑833, an improperly set flag during initialization. The low‑latency transmit flag, dev->lltx, is incorrectly assigned after early returns in the initialization functions instead of before. Consequently, GRE, GRETAP, or IPv6 GRE tunnels that enable sequence numbers or checksums lose lockless transmission and re‑acquire the qdisc_xmit_lock. Because the transmit path re‑enters the network stack during packet forwarding, holding this lock can trigger an ABBA deadlock that blocks the network stack and can halt system communication.

All Linux kernel installations that include the GRE module are vulnerable. The issue resides in the default kernel source code, and any kernel compiled with the standard GRE tunnel implementation before the commit 00d066a4d4ed is affected. No specific kernel version range is enumerated, so affects all kernels using the default GRE code path that has not applied the patch.

The CVSS score of 4.4 indicates moderate severity, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been documented. The likely attack vector involves generating or allowing GRE traffic that uses sequence or checksum options, which could trigger the deadlock. An attacker with network access to the system could create such traffic, but the low exploitation probability and lack of publicly available exploits reduce its immediate threat level.