In the Linux kernel, DHCP option construction appends the hostname, vendor‑class, and client‑ID options into a fixed 312‑byte buffer. The hostname and vendor‑class writes are unbounded; when a 64‑byte hostname and a 252‑byte vendor‑class are used, the helper requires 338 bytes, exceeding the buffer limit. The resulting out‑of‑bounds write triggers a field‑spanning write that, when panic_on_warn is enabled, causes the kernel to abort and the machine to crash during boot. This is a classic buffer overflow (CWE‑787) that results in a denial of service.

Linux kernels that build DHCP options into the 312‑byte bootp_pkt.exten[] buffer before the patch adding size‑checked helper are vulnerable. The CVE description does not specify exact version ranges; any kernel incorporating the faulty logic prior to the update can be affected. Once the updated logic that verifies the remaining space is applied, the issue is resolved.

The CVSS score of 4.1 indicates moderate severity, and the EPSS score of <1% suggests a low current exploitation probability. The vulnerability is not in the CISA KEV catalog. An attacker who can send malicious DHCP packets containing oversized hostname and vendor‑class values to a target system that uses DHCP for address resolution may trigger the overflow. If panic_on_warn=1, this can lead to a kernel panic and service interruption during boot or reboot, posing a moderate to high risk in environments accepting DHCP from untrusted sources.