The vulnerability is caused by improper validation of a mask pointer during nested attribute parsing in the class flower traffic‑control filter of the Linux kernel. The parser advances a mask pointer with nla_next() without re‑validating it, allowing the loop to dereference bytes beyond the true end of the mask payload. A malformed attribute can trigger a kernel out‑of‑bounds read detected by KASAN, which may in turn cause a kernel panic or leak information from memory. No direct evidence of execution or denial of service is provided, but the memory corruption could enable further exploitation if combined with other vulnerabilities.

All Linux kernel releases vulnerable before the commit that added the missing validation, which is present in all current stable kernel releases after that change. The issue affects the cls_flower component of the Linux traffic‑control subsystem and thus any system that uses network classification filters. The impact is limited to devices running a Linux kernel with the vulnerable traffic‑control code compiled into the kernel image or modules.

The severity metric is not listed, and the EPSS score is not available, but the vulnerability is not included in the CISA KEV catalog. The likely attack vector involves injecting a crafted filter packet through the traffic‑control subsystem, which normally requires privileged access to configure filters. Because the flaw is an out‑of‑bounds read rather than a write, exploitation may be limited to information disclosure or denial of service without immediate code execution. Given the lack of publicly disclosed exploits, the risk remains moderate but should be mitigated promptly.