In Linux kernels, the routine tap_get_user_xdp() parses a virtio-net header before assigning the skb->dev field. If the header carries a GSO packet with a deliberately zero protocol value, the code enters dev_parse_header_protocol while skb->dev is still NULL, causing a null-pointer dereference and a following kernel panic. As a result, the affected host will crash, leading to a denial-of-service that can be triggered by sending a crafted packet to the virtio-net device.

All Linux kernel releases shipping the tap_get_user_xdp() implementation and the vhost TX path before the patch commit are vulnerable. No specific version range is provided; however, any distribution with a kernel that includes the tap module prior to the commit that assigns skb->dev is affected. This flaw is relevant to systems that use virtio-net, such as virtual machines or containers communicating via vhost, and that expose the XDP interface.

The bug can be exploited by an attacker who can inject a specially crafted XDP buffer into the virtio-net device, which is usually limited to the local host or a trusted VM. The resulting crash removes availability but does not provide information disclosure or code execution. The EPSS score is <1 % and the CVSS score of 7.1 indicates a moderate to high severity; the vulnerability is not listed in CISA KEV, suggesting no publicly known exploits yet, yet the impact of a kernel panic is severe. The correct mitigation is to upgrade the kernel or apply the patch that assigns skb->dev before parsing the virtio‑net header.