The Linux kernel’s flowtable module incorrectly handles IPIP tunnel packets that are transmitted directly, such as when a bridge device forwards them. Because a destination entry is missing, the code does not verify packet headroom or set the IP fragmentation field, leading to the use of an invalid destination cache. This flaw triggers a kernel crash during the tunnel transmit path and results in a denial of service by abruptly halting kernel operations.

All Linux kernel implementations compiled with the flowtable module that support IPIP tunnels using the direct transmit mode are affected. No specific kernel versions are enumerated, so any pre‑patch kernel that follows this flowtable path is vulnerable. The vendor list indicates the ubiquitous Linux kernel across all distributions, meaning any system running such a kernel is impacted.

A CVSS score of 9.8 indicates critical severity, while an EPSS score of less than 1% points to a low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send crafted IPIP packets to a host that forwards such traffic through a bridge or similar path. The exploitation requires the target to accept and forward IPIP traffic, constituting a remote network attack vector. Although the complexity is moderate, the kernel crash it causes makes it a high‑impact threat.