The Linux kernel flaw causes a null‑pointer dereference in the TCP zero‑copy receive path when a NET_IOV_DMABUF or IOURING fragment is processed. During reception, the code attempts to map the fragment’s page, but because the fragment is a net_iov rather than page‑backed data, the page pointer is null. The resulting dereference triggers a Kernel Address Sanitizer panic, which brings the entire system process to a halt. This denial‑of‑service condition can be brought about by a crafted TCP packet that forces the zero‑copy path to handle a net_iov fragment while the kernel believes the data is readable.

The issue exists in any Linux kernel version that has not incorporated the patch which rejects net_iov fragments before the page check. All modern kernels that support zero‑copy receive on queues capable of DMA‑buf or IOURING net_iov fragments are affected, regardless of specific version numbers, as no explicit release list was supplied. Systems using the zero‑copy receive optimization for high‑throughput network traffic are therefore at potential risk.

Severity metrics such as CVSS are not provided, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote TCP connection that triggers the zero‑copy receive path with a net_iov fragment, which requires that the system’s network interface supports DMA‑buf‑bound queues and that the CONFIG_NET_DEVMEM kernel option is enabled. An attacker who can send traffic to the vulnerable interface can induce a kernel panic, causing system downtime. Exploitation is limited to environments that use the specific zero‑copy path, but the impact of a crash is significant for all affected hosts.