The CVE addresses a false‑positive memcpy overflow warning in the Linux kernel’s tun_dst_unclone function. The kernel correctly allocates space for tunnel options before copying them, so the actual memory footprint never exceeds the allocation. Because the compiler’s static analysis overestimates the size of the options field, a fortify warning is emitted even though no real buffer overflow can occur during execution. Therefore the issue does not provide a real attack surface.

The change impacts all Linux kernel builds that compile the net subsystem with Clang and enable source fortification checks. Any current or future kernel source that applies the described patch will trigger the warning. Systems using other compilers or without fortification checks are not affected.

The CVSS score of 8.2 reflects the severity that a genuine buffer overflow could have, but the EPSS score is under 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a very low likelihood of exploitation. The attack vector is purely a compilation artifact; no runtime exploitation path exists. In practice, the risk to deployed kernels is negligible unless source fortification is enforced.