The Linux kernel’s IPVS subsystem previously performed pskb_pull() on incoming packets without ensuring that the remaining inner IP headers in ICMP error messages from tunnels stayed within the packet buffer headroom. As a result, functions such as ipv4_update_pmtu(), icmp_send(), and IP_VS_DBG() could operate on insufficient data, potentially causing memory corruption or a kernel panic. This represents a classic instance of unsafe pointer access (CWE-131). The patch commits add explicit headroom checks and length validations for the inner headers. It is inferred from the description that the missing checks could lead to denial of service by crashing the kernel.

All Linux kernel implementations that include the IPVS module and have not applied the corrective commits mentioned in the advisory are potentially affected. Because specific available‑to‑update versions are not provided, any kernel version containing the vulnerable IPVS code before the patch series may be at risk.

The EPSS score is <1%, and the CVSS score of 9.8 indicates a critical severity; the vulnerability is not listed in CISA’s KEV catalog, yet the omission of bounds checks presents a high‑severity risk. Attackers would need the ability to inject or manipulate ICMP error traffic across a tunnel to the affected host, making the attack vector network‑based. The potential to trigger a kernel panic is inferred, therefore environments that accept untrusted tunnel traffic should treat this as a significant risk until the patch is applied.