The Linux kernel netfilter flowtable had a flaw where, during the process of pushing an IPIP header, the route from the reverse direction was incorrectly used to calculate the headroom. The correct route for the current direction should have been used. While accessing the other tuple for setting IP source and destination was acceptable, the bug affected the headroom and the fragment offset fields because the destination route for the current direction was available but not used. This issue was fixed by correcting the route usage in the flowtable code.

The vulnerability could lead to incorrect packet processing in the IPIP tunneling mechanism, potentially affecting network traffic handling. The description does not specify direct exploitation consequences such as privilege escalation or denial of service. No known exploits in the wild have been reported.

A fix has been applied in the Linux kernel to correct the route usage when pushing the IPIP header in the netfilter flowtable. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.