The vulnerability in the Linux kernel's netfilter flowtable subsystem involved the lack of validation of the IP header length (iph->ihl) in the nf_flow_ip4_tunnel_proto() function. Without this validation, malformed IP headers could cause out-of-bounds memory access when computing the header size. The fix adds a sanity check on iph->ihl before its use, preventing such memory access issues. Additionally, the patch replaces a hardcoded IPPROTO_IPIP constant with the dynamic iph->protocol field for setting tunnel protocol context, and references the tunnel header size when updating the context offset.

This vulnerability could lead to out-of-bounds memory access in the kernel when processing malformed IP headers in the netfilter flowtable code. Such memory access issues can potentially cause kernel crashes or other undefined behavior. No known exploits in the wild have been reported.

A fix has been applied to the Linux kernel to validate the iph->ihl field in nf_flow_ip4_tunnel_proto(), preventing out-of-bounds access. Users should update to the fixed kernel version once it is available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them accordingly.