The vulnerability arises in the Linux kernel’s packet socket implementation, where the device’s hard_header_len value is read multiple times during socket buffer allocation and construction. If a network device is reconfigured concurrently—for example, during bonding mode changes—the value may change between reads. In raw sockets, a larger reserve can be stored while a smaller headroom value is used later. This can shift the buffer data before the allocated head, and a subsequent copy from user space may perform an out‑of‑bounds write, corrupting kernel memory. A similar race exists in packet_sendmsg_spkt, where the reservation and header offset are calculated from separate reads before the RCU read lock is released.

All Linux kernel releases that have not incorporated the advisory’s commit series are potentially vulnerable, including any vendor distribution that includes the unpatched packet socket implementation. Specific kernel versions are not enumerated in the advisory, so any kernel version lacking the fixes should be considered at risk.

The CVSS score of 7.8 reflects a high severity, while the EPSS score is reported at < 1% (approximately 0.00156), indicating a very low probability of exploitation currently; the vulnerability is not listed in the CISA KEV catalog. The flaw requires an attacker to send crafted packets or bind raw packet sockets, which typically demands local system access or network privileges. The race condition can lead to kernel memory corruption, enabling an attacker to elevate privileges to root if the out‑of‑bounds write targets critical structures. Because the exploit is local and relies on concurrent device reconfiguration, the threat is moderate to high for environments that use raw or packet sockets.