A vulnerability in the Linux kernel allows a local attacker with low privileges to trigger an out-of-bounds read and potential denial of service by manipulating TCP reordering sysctl values.

The Linux kernel incorrectly handles net.ipv4.tcp_reordering sysctl values, allowing negative integers to wrap into large values. This overflow can cause tcp_mtu_probe() to perform an out-of-bounds read when tcp_mtu_probing is enabled, requiring low-level local access to exploit.

Successful exploitation of this vulnerability could lead to significant system instability or unauthorized memory access. Because the flaw exists within the kernel, an attacker could potentially crash the system, resulting in denial of service, or leak sensitive kernel memory contents. With a CVSS score of 7.1, this is a high-severity issue that demands attention, particularly for systems where local user access is provided to untrusted individuals.

Immediate Action: Update the Linux kernel to version 5.10.261, 5.15.212, 6.1.178, 6.6.145, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panics or repeated segmentation faults that may indicate an attempt to trigger this overflow condition.

Compensating Controls: Restrict access to sysctl configuration files and parameters to only authorized administrative users to prevent the injection of invalid TCP reordering values.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to kernel integrity and system availability. Security teams should prioritize the application of kernel patches provided by their Linux distribution maintainers. Ensure that all production environments are updated to the specified versions to mitigate the risk of local privilege escalation or system disruption.