The flaw arises in the netfilter flowtable IPIP processing path where the kernel incorrectly uses the destination information from the opposite direction when pushing the IPIP header. This misapplication affects only the headroom calculation and the IP fragment offset field early in packet construction. A malformed packet may be produced or the packet may be dropped, potentially disrupting connectivity for IPIP tunnels.

All Linux kernel installations that enable the netfilter flowtable and IPIP encapsulation are impacted, including generic Linux distributions that ship the kernel without vendor‑specific patches. Any kernel compiling with the default netfilter flowtable code before the fix is affected.

The EPSS score is <1%, indicating a very low exploitation probability. The vulnerability is not listed in CISA KEV, and the CVSS score is 9.8, placing it in the high severity range. Based on the description, the likely attack vector is a remote or local network‑based exploitation, where an attacker can craft packets that trigger the misuse of the destination address in the IPIP header. The flaw only impacts headroom calculation and the fragment offset field during packet construction. While the exploitability surface appears limited, exploitation could still lead to packet corruption or denial of service by causing the kernel to mis‑handle IPIP tunnel traffic. Since no public exploits are known, monitoring for unusual packet processing errors and applying the kernel update are recommended.