The Linux kernel’s IPTFS reassembly code mismanages an inner packet fragment that crosses an outer packet boundary, creating a runt fragment that bypasses normal IP length validation. An attacker sending a crafted inner packet with a total length between 6 and 19 bytes causes the kernel to write beyond the intended buffer while completing the inner header, leading to a kernel panic. This flaw is an instance of improper bounds checking that corrupts kernel memory. The resulting crash halts the host, delivering a denial‑of‑service condition.

All Linux kernel installations that enable IPTFS or operate an IPTFS VPN gateway are potentially impacted. The issue affects any kernel version prior to the commit that aligns the runt path with the normal reassembly logic. Systems that do not use the IPTFS subsystem or have that feature disabled are not affected.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, yet an unprivileged attacker can trigger it by sending or receiving specially crafted IPTFS traffic. The CVSS score of 5.5 indicates moderate severity. The flaw can be reached locally via user‑namespace IPTFS security associations or remotely through an IPTFS VPN gateway, making the threat viable against hosts that process such traffic. No additional system or software prerequisites beyond the presence of IPTFS are required, so the attack vector is straightforward for any entity capable of injecting or observing the relevant packets.