Linux kernel’s cls_u32 classifier accepts an offshift value from user space without bounds checking. The value is later used as the shift exponent in a 32‑bit expression during packet classification. When the offshift is 32 or greater, the shift operation triggers undefined behavior that may cause a kernel crash, resulting in a denial of service.

All Linux kernel images that include the cls_u32 classifier and have not yet applied the patch that rejects offshift values of 16 or more. This includes the default kernel supplied by most distributions. The issue resides in the net/sched subsystem and affects any system that allows unprivileged users to create traffic‑control filters inside network namespaces.

The CVSS score of 7.8 indicates high severity, but the exploit requires local action by an unprivileged user who can create a u32 filter within a network namespace. The EPSS score of <1% and the absence from CISA KEV suggest a low probability of widespread exploitation. The vulnerability is local; an attacker can inject a malicious u32 filter to trigger undefined behavior, potentially causing a kernel crash. The impact is therefore confined to the affected host’s availability.