The flaw occurs in the Linux networking stack, specifically within the VXLAN module. When the kernel is booted with IPv6 disabled, the neighbor discovery table required for IPv6 operations is never initialized. If an IPv6 packet is injected into a VXLAN interface, the code later inserts a NULL pointer dereference, leading to a kernel crash and a system halt. This type of failure results in an immediate loss of service for the affected node but does not provide an attacker with direct code execution or data exfiltration capabilities.

All Linux kernel builds that include the VXLAN driver and lack the fix introduced in the referenced kernel commit are vulnerable. The affected vendor is Linux, the product is the Linux kernel; any upstream kernel version preceding the change could be at risk.

The CVSS score of 5.5 reflects a medium severity, primarily due to the denial‑of‑service nature of the crash. EPSS indicates an estimated probability of exploitation below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation in the wild. An attacker would need the ability to inject crafted IPv6 packets to a VXLAN interface, which could occur via a local or remote network connection depending on system exposure. While the current scoring and lack of exploitation data imply a modest risk, a kernel crash on a production host can have critical operational impacts.