The Linux kernel’s flow_dissector function miscalculates the transport header offset (thoff) when the packet length exceeds 64 KiB due to a numeric truncation error (CWE‑681). The min_t(u16,…) macro casts both arguments to 16‑bit values before comparison, so for frames larger than 64 KiB the lower 16 bits of skb->len is used, producing a bogus small offset. Callers such as skb_probe_transport_header then return a header pointer inside the Ethernet header, leading to incorrect networking behavior and providing an attack surface where malformed packets could disrupt network processes.

All Linux kernel releases that contain the vulnerable flow_dissector implementation and have not yet incorporated the commit that caps the offset will be affected. The flaw has been documented in upstream kernel source and patch history, and therefore any kernel distributed prior to the patch must be considered vulnerable.

Because the error can only be triggered with GSO or TAP frames larger than 64 KiB, the likely attack vector involves sending crafted large packets over AF_PACKET interfaces or via virtual networking stacks that enable PACKET_VNET_HDR or GSO. The CVSS score is 5.9, the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. Even without an exploit in the wild, the potential to corrupt packet parsing could be leveraged to disrupt network services, making the defect moderate impact for systems that process user‑supplied network traffic.