Based on the description, it is inferred that pskb_carve() removes the leading bytes of a packet and reallocates the skb head, but fails to reset header offset fields such as mac_header, network_header, transport_header, and checksum_start. These stale offsets are subsequently accessed in later packet processing, which triggers a BUG and causes a kernel crash. The resulting kernel panic leads to a system‑wide denial of service; the advisory indicates that there is no data leakage or remote code execution path.

All Linux kernel releases prior to the commit that added skb_carve_reset_headers are affected. The exact version range is not specified in the advisory, but any kernel that still implements the old pskb_carve logic is vulnerable. The vulnerability is confined to the networking stack and is triggered only through packet handling paths that invoke pskb_carve, which currently includes the RDS protocol.

Based on the CVSS score of 7.0, the vulnerability is considered high severity. The EPSS score of less than 1% indicates a very low probability of exploitation; thus, it is inferred that exploitation attempts are currently rare and no public exploit exists. The vulnerability is reachable from the network, and, as noted, only the RDS protocol currently invokes pskb_extract, so the attack vector is likely limited to crafted RDS packets. If successfully exploited, the kernel will panic and the entire system will be denied service.