The Linux kernel’s netfilter flowtable module calculated packet header size by reading the IP header length field, iph->ihl, without verifying that the value was within the valid range. A crafted packet with an inflated IHL value could cause the kernel to read beyond the packet buffer, creating an out‑of‑bounds memory read that could leak sensitive kernel data. The weakness is classified as CWE-125 (Out‑of‑Bounds Read).

All versions of the Linux kernel that do not contain the two commits (025a41e76b51fbc7b8eaa5bacbaa9621d00e6aa7 or 84460b644329e25809b4a6d9279d6359d7fd8ebc) are potentially vulnerable. The commits add a sanity check for iph->ihl, replace the hardcoded IPPROTO_IPIP constant with iph->protocol, and correct header size calculations. These changes apply universally to Linux kernel builds in production.

The CVSS score of 9.8 indicates a high impact, while the EPSS score of < 1% suggests that active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based packet injection on any interface that processes IPv4 tunneling packets. The flaw introduces an unchecked packet header field, but the CVE does not imply an available write primitive or full code execution capability. However, an information disclosure could be leveraged in a larger attack chain if additional vulnerabilities are present.