The flaw arises in the netfilter flowtable IPIP processing path where the kernel incorrectly uses the destination information from the opposite direction when pushing the IPIP header. This misapplication affects only the headroom calculation and the IP fragment offset field early in packet construction. A malformed packet may be produced or the packet may be dropped, potentially disrupting connectivity for IPIP tunnels.

All Linux kernel installations that enable the netfilter flowtable and IPIP encapsulation are impacted, including generic Linux distributions that ship the kernel without vendor-specific patches. No vendor or version specifics are provided, but any kernel compiling with the default netfilter flowtable code before the fix is effected is potentially affected.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, implying no publicly known exploits as of the data set. The CVSS score is not supplied, so the severity cannot be quantified here. The attack vector is inferred to be local or remote with network interaction, because the flaw occurs during packet processing. Because the issue only impacts headroom and fragment offset handling, the exploitation surface is limited, but an attacker could craft a packet that triggers improper handling, possibly resulting in denial of service or packet corruption. As the vulnerability is not currently exploited, monitoring for abnormal kernel or packet errors is advisable.