In the kernel’s networking stack, the function packet_rcv_spkt restores the link-layer header by calling skb_push with a length computed from the difference between skb->data and skb->mac_header. When a network device has no visible link-layer header, the mac_header field remains at the sentinel value 0xFFFF. The calculation then yields a large negative number and skb_push triggers skb_under_panic, causing a kernel panic during a soft‑IRQ. An attacker with the CAP_NET_RAW capability can create a SOCK_PACKET socket and send frames to a device such as a CAN SLCAN interface; the kernel crash aborts the system, turning a single malicious packet into a denial‑of‑service event.

This flaw exists in all Linux kernels that lack the patch introduced by commit d549699048b4. It is most readily triggered on devices that do not expose a link-layer header, notably CAN interfaces configured with CONFIG_CAN_SLCAN or similar drivers. The vulnerable code path is exercised when packets are received on such devices via SOCK_PACKET sockets. All distributions that ship an unpatched kernel are potentially affected; no specific version range is provided.

The vulnerability has no publicly available exploit and is not reported in CISA KEV. The EPSS score is < 1%, and the CVSS score is 5.5. The attack requires local privilege (CAP_NET_RAW) to open a SOCK_PACKET socket and send frames to a device such as a CAN SLCAN interface; the kernel crash aborts the system, turning a single malicious packet into a denial‑of‑service event.