In the Linux kernel, the BPF flow dissector clamps packet offset values using a 16‑bit maximum derived from the packet length (hlen). When hlen exceeds 65535, the upper bound is truncated before the comparison, which forces both nhoff and thoff to zero even if a BPF program supplies valid values. This incorrect clamping misinterprets the packet structure and can lead to kernel data corruption or unexpected behavior.

All Linux kernel installations that have not incorporated the patch referenced in the provided commit logs are potentially impacted. The vulnerability resides in the core flow_dissect subsystem, so any kernel version prior to the fix may be affected.

The CVSS score of 3.7 indicates moderate severity, and the EPSS score of <1% shows a very low likelihood of exploitation in the wild. Because the flaw is only exposed through a BPF flow dissector, an attacker would need to inject malicious BPF code, which typically requires elevated privileges or the ability to load BPF programs. The vulnerability is not listed in the CISA KEV catalog, suggesting that no widely used exploit payload is currently known. If exploited, the kernel may suffer data corruption or other unexpected behavior due to incorrect packet parsing.