The flaw lies in the way IPv4 fragmentation is handled. When a fragment packet is directed to a path whose MTU is too low—specifically less than the header length plus eight bytes— the fragmentation routine creates fragments that contain only headers. This causes the fragmentation state to stall; the kernel continues to send header‑only fragments, never advancing the fragmentation process. The result is a hard kernel cycle that triggers the softlockup detector, effectively freezing the forwarding path and reducing overall system responsiveness. No arbitrary code execution is possible; the impact is limited to denial of service.

All Linux kernel implementations inheriting the buggy ip_do_fragment() logic are affected. The issue manifests on systems that forward packets to interfaces with MTU values below 28 bytes, such as a route configured with "mtu lock 20" or a physical device with a 20‑byte MTU. The kernel version before the applied patch is vulnerable; any release after the commit that adds the MTU check is presumed fixed.

The vulnerability can be triggered by sending crafted IPv4 packets that require fragmentation over a path with a very small MTU. An attacker with the ability to inject such traffic into the network can cause a kernel softlockup, leading to service denial until a reboot or restart of the affected process. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, so the current public exploitation probability is uncertain. However, the CVSS score is not provided in the advisory, implying that the severity is at least high due to potential widespread kernel impact. Administrators should treat this as a significant risk if small‑MTU interfaces exist in their environment.