The IFE (Intra‑Frame Encapsulation) decoder in the Linux kernel incorrectly marks the inner Ethernet header as available after only pulling the outer IFE header and metadata. Because the caller passes the decoded packet to eth_type_trans(), which expects the inner Ethernet header to be located in the linear part of the buffer, a malformed IFE frame can leave the inner header shorter than the required ETH_HLEN bytes in the linear area, leading to an out‑of‑bounds read and a kernel crash. This flaw manifests as a local denial‑of‑service via a system reboot or kernel panic.

Affected systems are all Linux kernel implementations that expose the IFE interface. The advisory does not list specific kernel versions, implying that any kernel which implements the original IFE decoder without the recent patch is vulnerable. The vendor products are identified simply as “Linux:Linux” in the CNA data.

The CVSS score of 9.1 reflects the high severity of a kernel crash. The EPSS score is reported as less than 1 %, indicating a low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the attack vector is likely to involve the transmission of malformed IFE frames over a network interface that can receive IFE traffic. The threat requires either local access to the affected system or the ability to deliver such frames to the target interface, so attackers who can reach or manipulate the network path are most relevant.