The Linux kernel GUE implementation incorrectly validates REMCSUM offsets. When the checksum field offset is less than the absolute start, an unsigned 16‑bit underflow occurs and the packet processing routine writes two bytes 64 KiB beyond the allocated buffer. This buffer overflow can corrupt kernel memory and, in a system where the packet is accepted by a hardware checksum offloading driver, can lead to arbitrary code execution at kernel privilege level. The vulnerability does not rely on user input beyond a malformed GUE packet and thus can be triggered purely over the network.

The flaw affects all Linux kernel builds that enable the GUE device type, as indicated by the CPE reference and the CNA vendor list. No specific kernel release numbers are supplied in the advisory; affected systems should check for the presence of the fix in the latest stable kernel series or the appropriate vendor patch stream.

No CVSS score or EPSS information is currently published, and the vulnerability is not listed in the CISA KEV catalog. However, because the defect involves an out‑of‑bounds write in a privileged kernel function and can be triggered via ordinary network traffic, the risk for systems that accept remote GUE traffic is high. Attackers would send specially crafted GUE packets to the target host, exploiting the checksum offset underflow to overwrite kernel memory. Without an official patch or change to the kernel configuration, a successful exploit could provide a local or remote privilege escalation to root level.