An improper handling of the virtual‑network packet ring causes a race condition that can leave a ring slot claimed after a failed header conversion. When a single‑frame TPACKET_V2 ring receives an unsupported UDP GSO packet, the only slot remains unavailable and the next valid packet is dropped, resulting in loss of traffic. The flaw does not disclose data or provide privilege escalation, but it can disrupt normal network operation by dropping legitimate packets and potentially blocking service if the loss is severe.

The affected component is the Linux kernel’s networking packet receive path (tpacket_rcv). The issue exists in kernels that support a V1 or V2 ring slot map before conversion of virtio‑net headers. The patch fixing the bug (commit 61fad6816fc1) has been incorporated in later kernel releases; any earlier kernel version that includes this commit chain remains vulnerable.

Exploitability is indicated by an EPSS score of <1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low probability of widespread exploitation. An attacker could trigger the race condition sending specially crafted UDP GSO packets into a host using a single‑frame TPACKET_V2 ring, leading to packet loss and a potential denial of service to applications relying on those packets. The likelihood of random failure is low, but an adversary can inject traffic to the target can reliably exploit the flaw. The CVSS score of 5.5 indicates a moderate severity.