An unchecked reload of the packet header in the Linux kernel’s MPLS path creates a use‑after‑free condition. During label stack traversal, the function may free the skb head and leave a stale pointer that is later dereferenced while extracting the inner IP header. The resulting kernel memory corruption can abort the kernel or, in some scenarios, enable arbitrary code execution or denial of service.

The flaw resides in the Linux kernel’s MPLS forwarding code. Any system running an unpatched kernel before the commit. Although specific kernel versions are not listed, the vulnerability was reproduced by sending a legal Geneve packet through a bareudp/MPLS multipath configuration, indicating that all kernels prior to the patch should be considered vulnerable.

The CVSS score of 5.9 reflects moderate severity, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV and sending a precise MPLS/Geneve packet to the target and relying on network connectivity; no publicly known exploit exists. The primary consequence is likely a kernel crash or denial of service, but the potential for privilege escalation cannot be ruled out if the memory corruption is exploited in a sophisticated attack.