In the Linux kernel, the General Receive Offload (GRO) subsystem was incorrectly validating the size of aggregated TCP packets. When packets larger than 64 KB were processed, the kernel performed a bounds check based on skb_headroom instead of the actual space before the MAC header. This oversight allowed crafted frames, such as those injected through the AF_PACKET socket interface, to slip past the guard checks and trigger an out‑of‑bounds write inside the socket buffer. The resulting corruption can cause kernel desynchronization, crashes, or arbitrary memory modification, which in turn enables an attacker to execute privileged code on the affected host.

The vulnerability affects Linux kernel versions prior to 7.0, specifically the stable series such as 6.18.y. Systems running these older kernels without the backported fix are at risk, while kernels 7.0 and later have a rewritten subsystem that eliminates the flaw.

No public CVSS or EPSS score is available for this issue and it is not listed in the CISA KEV catalog, yet the kernel bug is severe. The exploitation requires the ability to inject or manipulate network frames via AF_PACKET or a similar API. A local user or an attacker who can control traffic to the target can craft packets that trigger the out‑of‑bounds write, potentially leading to a privilege‑escalation or denial‑of‑service scenario. Given the covert nature of packet injection and the lack of defensive checks in older kernels, the practical risk remains high until the kernel is patched or an appropriate workaround is applied.