A flaw in the Linux bonding driver causes it to supply an incorrect or missing network pointer to the __skb_flow_dissect function, which can trigger a null-pointer dereference inside the kernel flow dissector. This results in a kernel panic and a complete denial of service for the affected system. The vulnerability is activated when the bonding driver processes a specially crafted socket buffer that lacks a valid net namespace pointer, leading to a fatal crash. The impact is limited to the kernel space, potentially affecting the confidentiality and integrity of the entire operating system via the crash mechanism.

The flaw affects all Linux kernel versions in the Linux:Linux product line, including the 6.19 release candidates (rc1 through rc6) and any earlier releases that have not applied the fix. Until the kernel is updated to incorporate the commit that resolves the issue, systems that load the bonding driver and process raw packets remain vulnerable.

The CVSS score of 5.5 places the vulnerability in the medium severity tier, and the extremely low EPSS score (<1%) indicates a very small probability of exploitation in the wild. The condition requires a local attacker with the ability to inject malformed socket buffers or deploy malicious BPF/XDP programs that target the bonding driver, which narrows the attack surface. Because the vulnerability leads to a crash, it is not likely to grant arbitrary code execution but does allow an attacker to cause an outage of the system. The absence from the KEV catalog suggests no widespread public exploitation has been observed.