The flaw lies in the handling of erroneous PPP frames in the Linux kernel’s asynchronous PPP driver. When a bad frame is received, the driver incorrectly resets the headroom of the socket buffer to zero, violating the NET_SKB_PAD guarantee. Subsequent frames are then reassembled into this corrupted buffer with insufficient space for the two‑byte inbound filter tag, causing an out‑of‑bounds write and a kernel panic. The panic is triggered during the receive path, resulting in a system‑wide denial of service.

All Linux kernel versions that implement the legacy ppp_async process_input_packet routine without the patched headroom handling are affected. The vulnerability is present in kernels that have not yet applied the change that drops erroneous PPP frames instead of resetting headroom. Distribution kernels shipping that code are therefore at risk until updated.

The CVSS score listed is 5.5, indicating a moderate severity, and the EPSS score is <1%, showing a very low but non‑zero likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. To exploit the flaw, an attacker must send corrupted PPP frames to a remote PPP connection. While this does not provide arbitrary code execution, the malformed frames trigger a kernel panic, resulting in a denial‑of‑service that can bring the entire system down. The attack vector is remote and requires only access to the PPP interface; no local privilege escalation is necessary.