The Linux kernel bug originates in the af_packet subsystem, where the tpacket_hdr.tp_len field is cast from a 32‑bit unsigned value to a signed int. If the length supplied by a caller exceeds the maximum representable int value, the comparison succeeds and a negative error code is returned to sock_sendmsg_nosec(). The negative value is then treated as an internal error and triggers a BUG() that terminates the kernel, producing a system panic. The consequence is a loss of availability for the affected host; the vulnerability does not provide direct code execution or data exfiltration capabilities.

All products based on the Linux kernel, prior to the inclusion of the af_packet header length fix. The vendor is Linux, kernel family. No specific version numbers were supplied in the CVE data.

There is no EPSS score available and the vulnerability is not listed in the CISA KEV catalog. The impact is catastrophic due to the kernel panic, and the likelihood of exploitation depends on the ability of an attacker to send crafted packets to an af_packet socket, which may require local or network access to the target. Based on the reproduction, the flaw can be triggered by a user‑mode program that writes to a socket using an invalid packet length, so local unprivileged or remote high‑privileged access could potentially lead to process crashes. The vulnerability is a classic sign‑extension or integer overflow problem (CWE‑190).