The vulnerability arises from a missing verification step in the kernel’s IUCV receive routine, allowing any Ethernet frame received on AF_IUCV socket regardless of the socket’s bound interface. This flaw permits injection of frames that are delivered to sockets belonging to other network namespaces or hosts on the same HiperSockets segment. Consequently, attackers can exhaust the accept queue, cause DoS, spoof peer identity in newly created sockets, inject data into existing connections, and confuse the IQD fabric with bogus replies. The weakness is an improper authorization check when routing frames to sockets.

All Linux kernel exists across every release vulnerable to the function implementation described. No specific version boundaries are provided in the advisory, so any kernel containing the unpatched code is vulnerable.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests the exploitation probability is currently low. The flaw is not listed in the CISA KEV catalog. Exploitation requires the ability to send raw Ethernet frames, which is normally scoped to processes with the CAP_NET_RAW capability or processes running in a network namespace where CAP_NET_RAW is granted. Substantial impact is possible allowing The attack vector is local, leveraging privileged raw networking, and is likely to be feasible in environments where where IUCV/HiperSockets modules are active.