The Linux kernel contains a flaw in the handling of transport headers for GSO packets after tunnel decapsulation. When a packet with GSO metadata is received through an IP tunnel, the kernel removes the outer headers but leaves the transport_header field pointing to a now‑nonexistent outer L4 header. If that packet is then forwarded at layer 2 by a bridge without first being processed by the local IP stack, the invalid transport_header value propagates into the transmission path. During the calculation of the GSO header length, the negative offset overflows and causes an out‑of‑bounds read, triggering a KASAN fault or page fault that crashes the kernel. The impact is a local or remote denial of service due to kernel panic or reset, with no known code‑execution or data‑leak capabilities.

Linux kernel implementations are affected. The CVE description does not specify exact kernel versions; however, the issue was fixed in updates that patch commit 7fb4c1967011 and subsequent releases. Systems running any Linux kernel older than the patched release that supports GSO on tun devices and bridges are vulnerable.

The conditions required for exploitation are non‑trivial: an attacker must inject a GSO‑enabled packet into an IP tunnel and have it forwarded through a bridge or HSR path without passing through the local IP stack. The vulnerability is not currently listed in the CISA KEV catalog, and the EPSS score of < 1% indicates a very low measured exploitation probability. The CVSS score of 7.5 reflects a high‑severity flaw that can lead to a kernel crash and denial of service; nonetheless, the crash severity warrants immediate attention, and the flaw is exploitable in environments where the described network topology exists.