In the Linux kernel, the General Receive Offload (GRO) subsystem incorrectly validates the size of aggregated TCP packets. When the subsystem processes packets larger than 64 KB, it checks free buffer space using skb_headroom instead of the actual space before the MAC header. This flaw allows crafted frames—such as those injected via the AF_PACKET socket—to bypass the bounds check, resulting in an out‑of‑bounds memory write inside the socket buffer. The overflow corrupts memory, can crash the kernel or overwrite critical data, and provides a path for an attacker to execute privileged code on the affected host.

The vulnerability affects Linux kernels older than release 7.0, notably the stable 6.18.y series and earlier. Systems running these kernels without the backported fix are at risk; kernels 7.0 and newer have rewritten the GRO handling to eliminate the flaw.

The CVSS score of 9.8 reflects critical severity. The EPSS score of < 1% indicates a low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an attacker who can inject or manipulate network frames via AF_PACKET or a similar interface. The likely attack vector is a local or remote user able to control network traffic to the target, for example by sending crafted packets that trigger the out‑of‑bounds write, potentially leading to privilege escalation or denial of service.