The Linux kernel’s IP Virtual Server (IPVS) subsystem had a flaw where the IPv4 Internet Header Length (IHL) field was not revalidated after packet fragments were read from the socket buffer. A local process could change the IHL to an unrealistic value, causing the checksum routine to reference memory beyond the packet boundaries. This out‑of‑bounds read may lead to kernel crashes, denial of service, or, in the most severe scenario, arbitrary code execution if an attacker can influence the over‑extended packet flow.

Any Linux system that runs the kernel with the IPVS module enabled is potentially vulnerable. The advisory does not enumerate specific kernel releases or distributions, so all versions containing the old IPVS implementation before the patch are at risk.

There is no CVSS score available and the EPSS value is not provided, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is triggered by manipulation of the packet IHL field after skb_ensure_writable(), which requires an attacker to have local or privileged access to craft malicious packets for the kernel to process. The lack of an exploit example suggests that the risk is moderate to high for systems where local malicious code can be introduced, but it does not represent an easy remote exploitation vector.