The Linux kernel function __skb_flow_dissect blindly copies 12 bytes from the Ethernet header of a packet when the FLOW_DISSECTOR_KEY_ETH_ADDRS key is requested, assuming the packet’s mac_header points to a valid Ethernet header. On headerless interfaces such as an L3 TUN device, mac_header points into the payload and contains uninitialized data. That garbage data is then used as a lookup key in a rhashtable and can corrupt internal kernel structures or trigger a kernel panic, resulting in a denial‑of‑service. The underlying weakness is a use of an uninitialized variable, a variant of memory corruption.

Any Linux kernel installation built before the commit that introduces a guard checking that dev->type equals ARPHRD_ETHER and verifies that skb_mac_header_was_set before reading ETH_ADDRS is vulnerable. All vanilla kernels and custom builds that do not include this patch are at risk, regardless of the distribution version.

The EPSS score is reported as less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating low prevalence of public exploitation. The CVSS score of 7.8 classifies it as a medium‑to‑high impact vulnerability. Exploitation requires privileged control over network configuration: creating a TUN device in L3 mode, attaching a multiq qdisc with a flower filter that matches on eth_src, and sending traffic through AF_PACKET. Therefore the attack surface is limited to privileged or local users who can manipulate networking components, but the potential impact is severe—a kernel crash or service interruption.