The bug in the Linux kernel’s veth driver occurs when an XDP program modifies packet fragment sizes. After the fragment area is adjusted, the driver copies the new fragment size into skb->data_len but fails to adjust skb->len. This mismatch causes skb_headlen() to report a linear size larger than the actual linear data. In the reported reproduction, __skb_datagram_iter copied 1024 bytes past the true linear tail into userspace, exposing kernel pointer data and other packet metadata. The original packet payload was displaced and truncated. Additionally, the old implementation could trigger SKB_LINEAR_ASSERT when bpf_xdp_pull_data() advanced data_end while fragments remained. The applied patch synchronizes data_len and len and uses skb_set_tail_pointer() to safely adjust the skb tail.

Affected systems include any Linux kernel configurations that expose the veth driver, regardless of distribution, for versions built before the patch referenced in the CVE. The vulnerability is tied to usage of XDP programs that manipulate fragment areas on veth interfaces. The issue is present in every kernel that still uses the pre‑patch skb handling logic for veth devices.

Because the CVSS score is unavailable and the EPSS score is not reported, the exact risk level cannot be quantified. The described bug permits a local attacker who can load or modify an XDP program on a veth interface to read kernel memory beyond the intended packet buffer, potentially exposing pointers and metadata. This same flaw can trigger a kernel crash via SKB_LINEAR_ASSERT, resulting in denial of service. The ability to exploit the flaw does not inherently require privilege escalation beyond the rights needed to load the XDP program. Based on the description, it is inferred that such an attacker would need CAP_SYS_ADMIN or equivalent eBPF execution rights.