Integer overflow in net/ipv4
A working PoC was successfully generated by AI
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state. The sysctl is stored as an `int` but copied into the `u32` `tp->reordering` field for new sockets, so negative writes wrap to large values.
7.1High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H0.14%
Not scored. CISA publishes an SSVC decision for a subset of CVEs.