The Linux kernel IPVS estimator kthread may write beyond the bounds of the ticks and tick_len arrays when the network namespace is torn down during its calculation phase. This out‑of‑bounds write corrupts kernel memory. The description indicates that such corruption can cause kernel crashes; the possibility of arbitrary kernel code execution is inferred from the nature of the memory overwrite, as kernel memory corruption can be leveraged by an attacker with sufficient privileges. The vulnerability is a classic out‑of‑bounds write weakness.

All Linux kernel builds that include the unpatched IPVS estimator code are affected. This applies broadly to any system running the official Linux kernel with the IPVS service enabled, including servers and network appliances that rely on IPVS for load balancing.

The CVSS score of 7.8 indicates high severity, and the EPSS score of < 1% denotes a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require local or privileged access to disable IPVS or trigger a namespace teardown while IPVS is active. Once the out‑of‑bounds write occurs, the attacker could potentially elevate privileges or cause a denial of service by crashing the system. The risk is significant for environments where IPVS is used and patching is delayed.