The vulnerability exists in the Linux kernel’s FOU (Forwarding/Outbound) subsystem. When a user issues a FOU_CMD_ADD with FOU_ENCAP_DIRECT and omits the optional FOU_ATTR_IPPROTO, the kernel fails to detect the missing attribute. The configuration structure is zeroed, leaving cfg->protocol as zero. During packet handling, this zero protocol causes each received packet to leak its sk_buff, as the skb is not freed. The leak accumulates until kernel memory is exhausted, resulting in a denial of service. The weakness can be classified as a resource leak (CWE‑399).

All Linux kernel builds that do not include the patch introduced in commit 7a9bc9e3f423 are vulnerable. Vulnerable kernel versions include the 7.3.0‑rc3 and earlier releases that support the FOU_ENCAP_DIRECT feature. Any system that creates a FOU_ENCAP_DIRECT socket without specifying an IP protocol – for example, through netlink configuration or user‑space tools that wrap the netlink commands – is at risk. This applies to distributions that ship the affected kernel series and to environments running custom kernels that have not been backported.

The exploit requires the ability to send netlink commands to the kernel, which typically means the attacker must have CAP_NET_ADMIN or be a privileged user on the host. The exploitation surface is the public netlink interface to the FOU subsystem. An attacker can repeatedly create a FOU_ENCAP_DIRECT socket without providing the IPPROTO attribute, causing predictable memory leaks. Without a kernel patch, the attacker can exhaust kernel memory and trigger a denial of service. The EPSS value is not available and the vulnerability is not listed in CISA KEV, but the severity is moderate to high for local privileged users. The primary attack vector is local privileged netlink.