The flaw in the Linux kernel’s virtio network packet handling bypasses flow dissection for certain GSO packets when the skb->network_header field is zero. The incomplete parsing leaves the transport header unset or pointing outside the packet, causing an out‑of‑bounds read when calculating the GSO segment. This leads to a kernel crash as shown by KASAN errors, resulting in denial of service for the host machine. The core weaknesses include an uninitialized read leading to out‑of‑bounds access (CWE‑125).

The vulnerability affects the Linux kernel, specifically the virtio network driver path. No specific kernel release identifiers are listed in the advisory, so any system running a version prior to the commit that introduced the fix—9e8db5913264—is potentially vulnerable. Victims include hosts using tun devices, virtnet, and raw sockets that call the affected helper functions.

The defect causes a crash rather than arbitrary code execution, and the CVSS score of 5.5 categorizes it as Medium severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires delivering a crafted GSO packet to a privileged network device, a scenario that is plausible in environments with untrusted guest VMs or tunnel interfaces. The risk is therefore high for systems that expose such interfaces. Several kernel code paths bypass proper validation, indicating a credible attack surface for denial of service.