In the Linux kernel, the DSA BRCM legacy FCS tagger incorrectly calculates a CRC over the entire skb length without ensuring sufficient tailroom. When a nonlinear skb reaches the tagger, the CRC routine reads past the linear head into unrelated slab memory, triggering an out‑of‑bounds read. This can expose sensitive kernel data and may lead to system instability, as demonstrated by KASAN reports. The flaw is a classic buffer overread (CWE‑125) and affects any kernel that still includes the unpatched tagger path.

All Linux kernels that include the legacy DSA BRCM tagger without the patch are vulnerable. The CVE report does not list specific kernel version numbers, so any installation running the affected code path before the fix is at risk. Administrators should assess whether their kernel employs DSA and the legacy BRCM tagger.

The EPSS score is <1% and the vulnerability is not in the CISA KEV catalog. The CVSS score is 5.5. The bug can be triggered by sending crafted network packets that cause a non‑linear skb to be processed by the DSA tagger. Because the tagger runs in kernel space, an attacker with network access to the affected device could potentially read kernel memory. The attack vector is therefore likely network‑remote, and the remediation priority is high because the flaw allows information disclosure.