A critical memory handling vulnerability in the Linux kernel allows for potential remote code execution or system instability by mismanaging packet metadata during LWT encapsulation.

The vulnerability arises from the incorrect management of skb (socket buffer) metadata during LWT encapsulation. An unauthenticated attacker can trigger this flaw by sending specifically crafted packets that cause the kernel to overwrite metadata in the skb headroom or cause kernel warnings and memory errors, potentially leading to system compromise.

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Because it resides in the core networking stack and can be triggered by unauthenticated network traffic, it poses a severe risk of denial of service or remote code execution, which could lead to full system compromise, data theft, and significant operational disruption for any infrastructure relying on Linux-based networking.

Immediate Action: Update the Linux kernel to version 7.1.5 or later, as this release contains the necessary fix to properly drop metadata before LWT encapsulation.

Proactive Monitoring: Monitor system logs for kernel warnings, specifically those referencing skb_data_move or napi/iconduit-g, which may indicate an exploitation attempt.

Compensating Controls: Implement strict ingress filtering and utilize network-level firewalls to drop malformed or unexpected LWT-encapsulated traffic before it reaches the kernel processing path.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level vulnerability, organizations should prioritize patching their Linux distributions immediately. Testing and deployment of the 7.1.5 kernel should be conducted in a controlled environment before rolling out to production systems to ensure compatibility, while maintaining strict network perimeter defenses in the interim.