The Linux kernel TCP IPv6 code had a flaw where ip6_default_advmss() could return IPV6_MAXPLEN (65535) as the MSS when the MTU was large. Since 0xFFFF (65535) is also used as a magic value GSO_BY_FRAGS in the kernel, TCP packets with gso_size=0xFFFF were incorrectly treated as GSO_BY_FRAGS in skb_segment(), causing a NULL pointer dereference due to the absence of a frag_list in local TCP packets. The fix involved returning the minimum of IPV6_MAXPLEN and GSO_BY_FRAGS - 1 (65534) from ip6_default_advmss() to avoid this conflict, along with updating related comments.

This vulnerability can cause a kernel NULL pointer dereference leading to a denial of service (system crash) when processing specially crafted TCP IPv6 packets with large MTU values. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel source code to address this issue by adjusting the MSS calculation to avoid the GSO_BY_FRAGS magic value. Users should apply the official kernel updates or patches that include this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official patch and update guidance.