The vulnerability stems from an unchecked accumulation of packet lengths in the TX ring. Each validated transmit request adds its length to a signed integer counter. When the total exceeds the maximum positive value for that type, the counter overflows into the negative range, producing a result that triggers a BUG in the kernel. For a CAP_NET_RAW holder, this BUG causes the kernel to panic, halting the entire system. The flaw does not directly expose information or provide remote code execution but results in denial of service at the operating system level.

All Linux kernel versions that implement the tpacket TX ring logic before the patch are affected, including the arm64 build of Linux 7.3-rc4 where the issue was originally reproduced. The problem exists in any kernel configuration that creates and uses TPACKET_V2 transmission rings for packet capture or sending.

The risk is moderate (CVSS 5.5) because an attacker with CAP_NET_RAW privileges can trigger a kernel crash by sending numerous large packets, causing the system to become unavailable. The exploit requires local or privileged access; remote exploitation is not indicated by the available data. The EPSS score is < 1% and the vulnerability is not currently listed in the CISA KEV catalog, but the potential for a catastrophic denial of service warrants immediate attention.