The stmmac_tso_xmit() function in the Linux kernel network driver stores the protocol header length returned by stmmac_tso_header_size() in an 8-bit variable. When a TCP over IPv6 packet contains many hop‑by‑hop or destination options, the computed header length can exceed 255 bytes while remaining below the 1023‑byte limit that stmmac_tso_valid_packet() accepts. The 8‑bit field truncates such values, causing an incorrect header length to be used. This truncation can lead to malformed packet handling within the kernel, potentially degrading network performance or producing subtle protocol errors. The vulnerability does not involve privilege escalation and relies on the normal network traffic path.

All Linux kernel releases that include the stmmac network driver before the patch that widens the proto_hdr_len field to an unsigned int are affected. The fix is present in the kernel commit that updates stmmac_tso_xmit(), so any kernel that has not incorporated this change may process the erroneous header lengths when receiving specially crafted TCP/IPv6 packets.

The CVSS score of 5.5 and an EPSS score of < 1 % indicate a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the flaw by sending a crafted TCP over IPv6 packet with extensive hop‑by‑hop or destination options to a target machine’s stmmac interface. No elevated privileges are required; the flaw resides in the kernel’s network code, so normal network access to the interface is sufficient.