In the Linux kernel, the gve driver miscalculates the header length for UDP GSO packets by always calling skb_tcp_all_headers(), which reads the TCP doff field. Since UDP packets do not have a TCP header, the code uses an illegal length that can range from 0 to 60 bytes instead of the correct UDP header length plus eight bytes. This miscalculation shifts the segment boundary calculation in gve_can_send_tso(), causing the driver either to disable GSO unnecessarily or to hand the device a packet with more data descriptors than the maximum allowed. The resulting kernel or driver misbehavior can lead to packet drops, crashes, or other network stack instability, effectively disrupting service.

The affected product is the Linux kernel. No specific version list is provided in the CVE data; the fix was introduced in a recent commit to the mainline kernel. Any Linux distribution that does not include this commit is potentially vulnerable.

The CVSS score is 5.5 and the EPSS score is less than 1% suggesting limited exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The risk is moderate: an attacker could attempt to trigger the flaw by sending crafted UDP packets that activate GSO on a GVE device; this attack vector is inferred from the description because the CVE does not explicitly state it. If the flaw is triggered, it could cause service disruption. No high‑severity impact such as remote code execution is documented.