The netfilter flowtable component of the Linux kernel contains a flaw in nf_flow_ip4_tunnel_proto() where the IP header length field, iph->ihl, is used unvalidated to calculate the packet header size. An attacker can craft a packet with an overly large ihl value, causing the kernel to read beyond the bounds of the packet buffer. This out‑of‑bounds read may leak kernel memory and, if combined with an auxiliary write primitive, could enable arbitrary code execution or a denial of service at the kernel level.

All Linux kernel releases that include the netfilter flowtable module are potentially affected. The patch commit that introduces the ihl sanity check was published in the kernel source repository (see the provided Git links), but no specific version range is listed. Therefore any kernel that has not yet incorporated the commits identified by the hashes 025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7 or 84460b644329e25809b4a6d9279d6359d7fd8ebc should be considered vulnerable.

No publicly documented exploits are available and the EPSS score is not provided, yet the lack of input validation implies a high severity. Attackers can exploit this over the network by sending crafted IP packets to a target system that has the vulnerable flowtable code active. Because the flaw occurs in the kernel, successful exploitation could provide elevated privileges or complete system compromise. The vulnerability is not yet listed in the CISA KEV catalog, indicating no confirmed exploitation to date.