The flaw lies in the handling of erroneous PPP frames in the Linux kernel’s asynchronous PPP driver. When a bad frame is received, the driver incorrectly resets the headroom of the socket buffer to zero, violating the NET_SKB_PAD guarantee. Subsequent frames are then reassembled into this corrupted buffer with insufficient space for the two‑byte inbound filter tag, causing an out‑of‑bounds write and a kernel panic. The panic is triggered during the receive path, resulting in a system‑wide denial of service.

The defect exists in all versions of the Linux kernel that include the legacy ppp_async process_input_packet routine unchanged from the reported code path. No specific version list is supplied, so any kernel prior to the patch that still uses this headroom handling logic is considered vulnerable. All distribution kernels shipping that code are therefore affected.

The CVE data lists a CVSS score of 5.5 and an EPSS score of <1%, indicating a moderate severity and a very low but non‑zero likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Exploitation requires the attacker to send corrupted PPP frames to a remote PPP connection. While the attacker cannot gain arbitrary code execution, the malformed frames trigger a kernel panic, resulting in a denial‑of‑service that can bring the entire system down. The attack is remote and does not depend on local privileges beyond access to the PPP interface.