The vulnerability resides in the Linux kernel’s IP Virtual Server (IPVS) module. In the code path __ip_vs_get_out_rt(), an skb_ensure_writable() call may reallocate the skb->head buffer without reloading the header data. This can lead the kernel to reference stale or invalid memory, causing a crash or resulting in a denial of service. The flaw is a memory corruption weakness that directly undermines kernel integrity.

All Linux kernel implementations that include the vulnerable IPVS code are potentially affected. The CVE lists only the generic Linux kernel, so any distribution running an unpatched kernel version containing this code could be impacted.

The vulnerability’s mechanism indicates a high‑severity kernel memory corruption in a networking component. The EPSS score is unavailable and the vulnerability has not yet entered the CISA KEV catalog, yet the absence of a public exploit does not mitigate the risk. An attacker could send a crafted packet to a system running the vulnerable IPVS, triggering the head reallocation and potentially causing a kernel crash or denial of service. Network filtering may help reduce exposure, but the most effective mitigation is to patch the kernel.