The Linux kernel’s Generic Segmentation Offload (GSO) implementation for IP‑in‑IP traffic can re‑enter its segmentation routines for each nested IP header. Because the recursion counter only tracks header length instead of the depth of callback calls, a sufficiently deep chain of encapsulated packets can deplete the kernel stack. The patch introduces a limit using the existing IP_TUNNEL_RECURSION_LIMIT and returns an error before additional recursive calls are made, preventing the stack exhaustion that previously could crash the kernel and suspend services. The exploit would lead to a denial of service by causing instability or kernel panics.

This issue affects the Linux kernel – any release that lacks fixed GSO limit. Version information is not supplied, so all kernels prior to the application of this patch are potentially vulnerable. Administrative oversight must verify that the kernel in use includes the recent commit that limits recursive IP‑in‑IP segmentation.

The vulnerability has a CVSS score of 7.5, indicating high severity. An attacker who can send crafted packets over the network could construct arbitrarily deep nested IP‑in‑IP encapsulations, exhausting the kernel stack and causing a crash. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalogue, suggesting no currently known public exploitation. The attack vector is inferred to be network‑directed, so exposed services face a significant risk.