The Linux kernel’s PFCP packet handler contains a linearity check that verifies only the UDP header and the 4‑byte PFCP header reside in the linear area of the socket buffer. When a PFCP packet carries the S flag, the handler reads an additional 8‑byte SEID field that is not covered by this check, allowing the code to read kernel memory beyond the end of the actual packet data. This out‑of‑bounds read copies accidental or malicious data into tunnel metadata, which later influences traffic classification and could result in memory disclosure or a kernel crash.

All Linux kernel builds that include the PFCP stack and have not applied the commit adding the SEID linearity guard are affected. Kernels lacking PFCP code or those that have already incorporated the fix are not impacted. The vulnerability applies broadly to systems running network function virtualization or mobile core network components that employ PFCP.

The flaw is reachable from the network; an attacker must craft a PFCP packet with the S flag or a fragmented session header that is smaller than the required 12‑byte header. The CVSS score of 7.3 indicates a high severity, but the EPSS score of less than 1% points to a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Nonetheless, the ability to read arbitrary kernel memory or trigger a crash remains a serious risk until remedied.