The flaw occurs because the kernel assumes the redirect array size for XDP frames is smaller than the maximum number of fragments in a frame, leading to an out‑of‑bounds array read. This can corrupt memory, causing system instability, denial of service, or potentially enabling arbitrary code execution. The weakness stems from an improper bounds check in the ENETC driver and is classified as a buffer overread or index validation issue.

The vulnerability is present in the Linux kernel networking stack, specifically the ENETC driver used by network interfaces. All Linux kernel releases that include this driver without the state‑of‑the‑art patch are susceptible regardless of distribution.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1% suggests a low probability of exploitation at present. The out‑of‑bounds access can be triggered by crafting network packets that exceed the expected fragment count of an XDP frame. An attacker who can generate such traffic could cause a crash or exploit the memory corruption for system compromise. The vulnerability is not listed in the CISA KEV catalog, indicating that no widely used exploits are known yet, but the risk remains if an exposed service runs an unpatched kernel.