The Linux kernel failed to validate the length of the REMCSUM private option when the GUE_PFLAG_REMCSUM flag is set. Because guehdr_priv_flags_len() incorrectly returned zero, a crafted packet could bypass option validation and cause the kernel to read nonexistent REMCSUM start/offset fields from subsequent bytes, resulting in an out‑of‑bounds memory read. This flaw can lead to kernel crashes or unintended information disclosure if the read exposes sensitive data.

All Linux kernel releases that do not incorporate the patch fixing GUE private option length validation are affected. The vendor is Linux, and the vulnerability applies to kernel code that processes Generic UDP Encapsulation (GUE) packets with the REMCSUM flag.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score remains below 1%, suggesting that widespread exploitation is unlikely but not impossible. The flaw is network‑based and can be triggered by remote attackers sending malformed GUE packets. Without the fix, an attacker could repeatedly send such packets to destabilize services or potentially reveal memory contents, achieving a denial of service or limited data exposure. The KEV catalog does not list this vulnerability, implying no confirmed mass exploitation to date.