The Linux kernel has a flaw in the IP‑TFS fragment handling code where the function iptfs_skb_reset_frag_walk() advances past the number of fragments in a packet without ensuring the index stays within bounds. This out‑of‑bounds read occurs on a fixed‑size stack array that is not protected against large offsets. An attacker can trigger the code path by delivering a specially crafted IP‑TFS packet, causing the kernel to read memory outside its intended region, potentially revealing sensitive stack contents or causing a kernel crash.

Linux kernels that compile with IP-TFS support are affected. Versions prior to the commit that introduces the guard in iptfs_skb_can_add_frags() remain vulnerable. As no explicit version list is supplied, all standard distributions should check whether their running kernel includes this patch.

The EPSS score is less than 1%, indicating a low probability of exploitation from public sources. The vulnerability is not listed in CISA’s KEV catalog. It can be reached from the network via a malicious IP‑TFS packet and could lead to kernel instability or disclosure of kernel memory. The CVSS score of 5.5 indicates moderate severity. In environments where IP‑TFS fragmentation is enabled and untrusted traffic is received, the risk is moderate, particularly if a kernel crash would disrupt critical services.