The Linux kernel’s network subsystem mishandles packet metadata when performing Layered Tunneling (LWT) encapsulation. Skb metadata, which is used to transfer information between XDP and traffic control (TC), is stored in the packet headroom immediately before skb->data. During LWT encapsulation, libskb functions (skb_push, skb_pull, or bpf_skb_change_head) move skb->data, inadvertently overwriting or clearing the metadata located in that headroom. This manifests as a data‑corruption bug that fits the description of an off‑by‑one or improper buffer management flaw (CWE‑193) or a buffer over-read/underflow (CWE‑787).

All Linux kernel releases that include the LWT subsystem before the fix are affected, because the flaw exists in the generic net subsystem. The patches referenced in the advisory trace back to commits in the 6.18 series, indicating that any kernel version prior to those commits, including 6.18.0 through 6.18.20, could experience the issue. Consequently, any system running a Linux kernel that has not applied these patches, especially those that enable LWT tunneling or BPF redirect programs on forwarded packets, is potentially vulnerable.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score is less than 1%, suggesting a low likelihood of exploitation at this time. The advisory does not list the vulnerability in the CISA KEV catalog. Attackers can trigger the vulnerability by sending or forwarding packets that carry XDP metadata through LWT encap routes, exploiting the network‑based path. Although a formal denial‑of‑service or crash scenario is not explicitly described, the loss of metadata can lead to malformed packet handling, kernel warnings, and degraded network reliability. No documented exploit code is available in the advisory.