The Linux kernel's net.ipv4.tcp_reordering sysctl was vulnerable because it accepted negative values that, when stored as an int and copied into a u32 field, wrapped to large unsigned values. When tcp_mtu_probing was set to 2, this wrapping could cause an overflow in the tcp_mtu_probe() size calculation, leading to out-of-bounds reads. The fix involved rejecting invalid tcp_reordering values before they affect TCP socket state, enforcing minimum values for tcp_reordering and tcp_max_reordering via proc_dointvec_minmax(), relocating pointers for network namespaces, and changing size calculations in tcp_mtu_probe() to use 64-bit arithmetic to prevent signed integer overflow.

This vulnerability allows an attacker with local privileges to cause out-of-bounds memory reads in the kernel, potentially leading to denial of service or information disclosure. The CVSS score of 7.1 reflects high impact on confidentiality and availability, with low attack complexity and requiring low privileges but no user interaction.

A fix has been implemented in the Linux kernel to validate and reject invalid tcp_reordering sysctl values and to harden the tcp_mtu_probe() function against integer overflow. Users should apply the official kernel updates that include these patches. Since no patch links are provided here, check the Linux kernel vendor advisories or trusted kernel update sources for the relevant fixed versions. Patch status is not yet confirmed in this data—consult vendor advisories for current remediation guidance.