The vulnerability stems from the Linux kernel’s TIPC subsystem, where netlink commands TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept arbitrarily large MTU values but enforce only a minimum bound. When a user supplies a value exceeding the 16-bit maximum of 65535, the value is silently truncated when stored in u16 fields. This truncation can yield the numeric zero, causing a division by zero in tipc_link_set_queue_limits and resulting in a kernel crash. Because the crash occurs in response to a netlink message, an unprivileged user can trigger it, leading to a denial-of-service attack against the host.

All Linux kernel releases that lack the patch committed in the kernel commit tree (e.g., commit 1b8fb5a20508bfb0db854e01214888c761b3a911) are affected. The issue is present in the TIPC code path regardless of distribution, affecting every vendor build of the Linux kernel that has not yet incorporated this fix.

The CVSS score of 7.8 indicates a high severity impact: a successful exploitation results in a kernel crash without any requirement for elevated privileges, making the attack trivial for any local user with access to netlink interfaces. The EPSS score is < 1%, and the CVE is not listed in CISA KEV, indicating no publicly known exploit. Nonetheless, the local nature of and the complete denial of service make it a priority for immediate remediation. The fix rejects MTU values above 65535, removing the numerical overflow and preventing the crash.