The Linux kernel bug originates in the af_packet subsystem where the tpacket_hdr.tp_len field, a 32‑bit unsigned integer, is cast to a signed int in tpacket_parse_header(). If a caller supplies a length larger than INT_MAX, the condition 'if (unlikely(tp_len > size_max))' incorrectly treats the value as a negative error code. This negative value propagates to sock_sendmsg_nosec(), causing a BUG() that triggers a kernel panic. The flaw is an example of improper integer conversion (CWE‑681) and results in a loss of availability for the affected host.

All Linux kernel‑based systems that include the af_packet implementation and have not applied the recent patch that removes the unsafe cast. The affected kernel releases span all recent stable branches, including the 7.3 rc1 and later, as indicated by the provided CPE strings.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of < 1% implies a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires the ability to send crafted packets to an af_packet socket, which may be achieved via local privileged processes or network exposure to raw AF_PACKET sockets. Exploitation conditions involve constructing a packet with a length exceeding INT_MAX; the kernel will crash upon processing such a message, providing a clear denial‑of‑service outcome.