The vulnerability in the Linux kernel involves a routing loop where the function dev_fill_forward_path repeatedly resolves to the tunnel device itself. This loop causes the function to fail and triggers a WARN_ON_ONCE warning when a flowtable attempts to offload traffic through the tunnel. The resulting failure leads to packet loss or transmission errors for tunnels that have been misconfigured by a CAP_NET_ADMIN user. No code execution or credential escalation results, but the loop can degrade network performance and stability.

All Linux kernel builds that include the dev_fill_forward_path path prior to the inclusion of commit 008e7a7c293b, which removed the erroneous warning and improves the error handling of the forward path walk. The vulnerability affects both IPv4 IPIP tunnels and IPv6 IP6_TNL tunnels for any distribution that ships the affected kernel version.

Expected exploit by a privileged network administrator who creates a routing loop by configuring a tunnel’s remote endpoint to point back at the tunnel device. The vulnerability is rated with a CVSS score of 5.5, indicating a moderate risk, and has an EPSS score of less than 1 %, suggesting a very low likelihood of exploitation from external adversaries. Because it is not listed in the CISA KEV catalog, there are no known active exploits. In heavily tunnel‑offloaded environments, the looping route can result in packet loss and service disruption, effectively behaving as a denial‑of‑service for the affected tunnels.