The Linux kernel CAN stack removed critical header initialisation from newly allocated socket buffers, causing internal packet buffers to carry an incorrect MAC header value. When these corrupted buffers reach the packet receive path, a push‑length calculation overflows, triggering a kernel BUG and a full machine panic. The vulnerability is triggered by sending malformed CAN frames and can be exploited without any special privileges, leading to a denial‑of‑service by crashing the host.

Any Linux kernel that contains the commit 9f10374bb024, which removed the skb_reset_* calls from init_can_skb(), and has not yet incorporated the upstream restoration of these initialisations (commits 969439016d2c and d549699048b4) remains affected. Standard Linux distribution kernels that have not been updated after this commit are therefore at risk.

The CVSS score of 5.5 classifies this bug as medium severity, and an EPSS score of less than 1 % indicates a very low current exploitation probability. Nonetheless, the impact is a total system crash. The likely attack vector is external CAN traffic; an attacker can craft frames that exploit the corrupted header without requiring privileged access, forcing the host to reboot and enabling repeated disruption.