The flaw lies in the veth driver’s handling of fragment lists when preparing packets for XDP. A frag_list socket buffer can arrive with an empty fragment array but data length set. The conversion routine incorrectly advertises fragment data to XDP based on incomplete checks. XDP copy mode then trusts this bogus metadata, walks an empty fragment entry, and crashes during a memcpy, causing kernel panic. The weakness is a classic out‑of‑bounds or uninitialized buffer access, which can be classified as CWE‑122.

All Linux kernel users with veth networking enabled, regardless of specific distribution, may be affected. No exact kernel version range is listed, so any current or older kernel that has not yet applied the commit addressing the issue is at risk.

The CVSS score of 9.1 indicates a high severity for this flaw. The EPSS score is < 1%, suggesting a very low probability of exploitation in the wild. Attackers would need to supply a packet that triggers the fragile XDP path on a veth interface. The likely attack vector is network‑based packet injection or, in some environments, local privileged users creating such packets. This still results in a full system crash, a severe denial‑of‑service risk even though exploitation probability remains low. The vulnerability is not listed in CISA KEV.