The Linux kernel contains a flaw in the IPv6 maximum segment size (MSS) advertisement logic. When a large MTU is configured, the function ip6_default_advmss returns 65535. TCP interprets this value as the magic GSO_BY_FRAGS flag, and when skb_segment processes a packet with gso_size 0xFFFF it mistakenly treats it as a fragment packet. Because local TCP packets do not provide a frag list, the code dereferences a null pointer, causing the kernel to crash. The crash results in a denial of service that disrupts all kernel services on the affected host.

All systems that use the Linux kernel and compile the vulnerable code are impacted. The vulnerability exists in the default Linux kernel code for IPv6, so any distribution that has not applied the patch, regardless of kernel version, may be vulnerable until updated. Systems that advertise a 65535 MSS for an IPv6 connection are at risk.

The CVSS score of 7.5 indicates a high severity impact with a crash that can be triggered by a malicious source sending packets with a large MSS. The EPSS score of less than 1% suggests that exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the crash by controlling the MTU or by sending specially crafted packets, but the vulnerability does not provide remote code execution. The risk is primarily a local or network‑level denial of service via a kernel fault.