A critical out of bounds memory access vulnerability in the Linux kernel netfilter component poses a severe risk of system compromise or denial of service.

The vulnerability exists in the nf_flow_ip4_tunnel_proto function within the netfilter flowtable subsystem. An unauthenticated attacker can trigger an out of bounds memory access by sending a specially crafted IP packet with a malformed header length, which the kernel fails to validate before processing.

The CVSS score of 9.8 reflects the high potential for full system compromise, as this flaw allows for memory corruption at the kernel level. Successful exploitation could lead to arbitrary code execution, unauthorized data access, or persistent system instability and service crashes, severely impacting business continuity and data integrity.

Immediate Action: Update the Linux kernel to version 7.1.5 or later to incorporate the necessary input validation checks.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected segmentation faults that may indicate failed or successful exploitation attempts.

Compensating Controls: Utilize network security appliances or firewalls to drop malformed packets or non compliant IP traffic before it reaches the vulnerable kernel flowtable processing logic.

Public Exploit Available: Unknown

Given the critical nature of this kernel level vulnerability and its potential for remote exploitation, organizations should prioritize patching as part of their next scheduled maintenance window. Ensure that all production Linux environments are updated to version 7.1.5 or higher to eliminate the risk of kernel memory corruption.