In the Linux kernel, a buffer overflow can occur when a PPP synchronised tty channel bridges a PPPoE frame that shares its buffer with an AF_PACKET socket. The kernel function ppp_sync_txmunge() prepends address and control bytes without ensuring the socket buffer header is writable. This allows an attacker to overwrite data visible to other sockets and corrupt kernel memory, potentially enabling privilege escalation or denial of service.

The vulnerability affects all Linux kernel versions prior to the fix that introduces skb_cow_head() in ppp_sync_txmunge(). No specific version numbers are supplied, so all kernels lacking the patch are at risk.

No CVSS or EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. While exploitation requires delivery of crafted PPP frames, the kernel memory corruption can be leveraged for remote code execution on systems that allow such traffic. The risk is considered moderate to high for environments that expose PPPoE interfaces and allow bridging to synchronous tty channels.