The vulnerability resides in the Linux kernel’s packet‑socket transmit path. When a driver accesses the MAC header during transmit, skb->mac_header may be unset, causing an out‑of‑bounds read roughly 64 KiB past the packet head. This read path can trigger a kernel fault, leading to a system crash or service interruption, effectively a denial of service.

All Linux kernel variants that have not yet incorporated the commit which resets the MAC header on the packet‑socket transmit path are affected. No specific kernel version ranges are enumerated in the advisory, so any kernel released prior to that patch is potentially vulnerable.

The exploit requires a user or process that can create and transmit a protocol‑bound SOCK_RAW or SOCK_PACKET socket via the PACKET_QDISC_BYPASS path, typically limited to privileged or locally running processes with CAP_NET_RAW. No publicly available exploits are known. The CVSS score of 7.8 indicates a high likelihood of impact, while the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The attack is purely local, thus the risk is moderate for environments where untrusted users can create raw packet sockets or where custom network drivers lack checks for unset MAC headers.