Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service
No sign of exploitation. No public exploitation artifact known so far.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
An attacker can send specially crafted network packets to a Linux system running kernel 4.9 or later, forcing it to perform expensive processing for each packet, which can overwhelm the system and make it unresponsive to legitimate users.
A remote attacker can exploit algorithmic complexity in the TCP stack (CWE-400) by sending crafted out-of-order packets that trigger expensive tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() operations on every incoming packet, causing CPU exhaustion and denial of service without requiring authentication or special privileges.