In the Linux kernel, the flaw lets an attacker specify a transmit queue length that exceeds the predefined 16-bit maximum. By assigning this oversized value directly to the device structure, the kernel allocates excessively large ring buffers for pfifo_fast, tun, and tap devices. The result is a denial-of-service condition caused by memory exhaustion and potential instability of the networking stack. The bug is triggered at netlink parse time, so the invalid attribute is accepted until after allocation, making the attack practical.

The issue arises in Linux kernels that have NET_SCHED, VETH, USER_NS, and NET_NS enabled. An attacker can reproduce it by creating a new user and network namespace and issuing the ip link command with a txqueuelen value larger than the allowed range. The vulnerability affects any system running a kernel version prior to the commit that enforces the cap at parse time.

The CVSS score of 5.5 indicates moderate severity, and EPSS score is <1%. The exploit path is straightforward: any user who can create or modify links inside a namespace can supply the oversized value. The vulnerability is local and does not require elevated privileges beyond the ability to use netlink in a namespace. Although it is not listed in the CISA KEV catalog, the potential for widespread denial-of-service makes it a high-risk concern for services that rely on large traffic queues.