Malformed IPv4/IPv6 packets such as TCP, IL, RUDP, or GRE sent with a total length shorter than the protocol header cause the 9front kernel to panic, immediately crashing the system and forcing a reboot. This disruption removes availability for legitimate users and can be triggered remotely without authentication.

The vulnerability resides in the 9front operating system kernel. No specific version numbers are listed, so all builds of 9front that use the default networking stack are potentially affected until the vendor’s patch is applied.

The CVSS score of 9.2 marks this flaw as Critical, indicating a high impact and easy exploitation. Because the EPSS score is less than 1% (approximately 0.04%) and no KEV listing exists, the actual exploitation risk relies on an attacker’s ability to craft the vulnerable packets, which can be done over the network from any remote host. The likely attack vector is remote packet injection, leading to a denial of service without requiring authentication or elevated privileges. The lack of authentication requirements makes the threat universally actionable against exposed 9front nodes.