A flaw in the Linux kernel reassembly logic allows Generic Segmentation Offload (GSO) metadata to persist on IP fragments after they are reassembled. The reassembled socket buffer still claims GSO, and the subsequent segmentation routine mistakenly assumes a GRO‑shaped input, triggering a BUG_ON that panics the kernel. The vulnerability does not provide code execution but causes a hard kernel crash, leading to a loss of system availability.

Any Linux kernel that includes the virtio_net_hdr path used by tap, tun, or AF_PACKET with PACKET_VNET_HDR interfaces is affected. The defect is present in all kernel releases before the patch that clears GSO fields during fragment enqueue, which shipped in 6.x and 5.x series after commit f43798c27684. Consequently, systems running those kernels and exposing the affected interfaces to local users are susceptible.

The flaw is local: an unprivileged user can trigger the panic by writing two GSO‑marked fragments to a tap interface within their own user namespace, or by possessing CAP_NET_RAW in a network namespace that performs defragmentation prior to a GSO operation. The CVSS score of 8.6 indicates high severity, and the EPSS score of < 1% suggests a low probability of exploitation, though the kernel crash is unavoidable once triggered. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation, but the potential for immediate denial of service warrants fast mitigation.