The vulnerability originates from the Linux kernel’s ip_tunnel implementation, specifically in the handling of Geneve tunnel options. When a Geneve tunnel is created, the driver uses an uninitialized counter, `options_len`, to calculate an offset into the options buffer. Because the counter is assigned only after it is used in a memcpy, the destination buffer size is effectively zero. The kernel is then asked to copy four bytes into this zero‑sized buffer, triggering a local buffer overrun that causes a kernel panic. An attacker can exercise this flaw simply by issuing network configuration commands, such as creating a dummy link and adding a Geneve route. The resulting panic drops the system into a halted state, causing immediate loss of availability for all services that depend on the kernel.

This flaw affects all Linux kernel builds that include the unpatched ip_tunnel code, notably when GCC 15 or newer is used together with `CONFIG_FORTIFY_SOURCE`. Distributed kernel binaries that have not received the upstream commit that initializes `options_len` before use are vulnerable. The issue is not limited to a particular distribution; any system running an affected kernel version is at risk.

The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local execution of privileged network configuration commands, typically through root or a user with elevated capabilities. While no confirmed exploits have been reported, the kernel panic provides a clear denial‑of‑service outcome that could be leveraged by a determined adversary to force a reboot or to disrupt critical services. The severity is thus high on impact, but the overall risk is moderated by the low exploitation likelihood. The CVSS score of 5.5 indicates moderate severity.