The vulnerability resides in the Firewire networking stack of the Linux kernel, where the reassembly logic for fragmented datagrams fails to correctly merge overlapping fragment ranges. Because the code assumes a neighboring fragment always exists at list boundaries and compares against the wrong fragment edge, a fragment that bridges two existing ranges may leave the datagram incomplete. This can cause the kernel to miss a fully assembled packet, resulting in loss of traffic or potential resource exhaustion, classified as a denial‑of‑service.

All Linux kernel builds that incorporate the pre‑patch firewire/net code are affected. Since the CVE does not list specific kernel versions, any kernel containing Firewire networking before the commit that applied this fix remains vulnerable. Custom kernels or distributions shipping older kernels should verify the presence of the patch commit. Systems that enable the Firewire networking module and can receive Firewire packets from connected devices are within scope.

The CVSS score of 8.8 indicates a high severity. The EPSS score is less than 1% and the vulnerability is not in the CISA KEV catalog, suggesting limited current exploitation activity. The attack vector is likely local, through a physical Firewire interface, and requires an attacker to send a crafted fragment that causes the reassembly code to fail. In environments where the Firewire net module is active and unwarned devices may connect, the risk remains significant.