The flaw occurs in the Linux networking stack, specifically within the VXLAN module. When the kernel is booted with IPv6 disabled, the neighbor discovery table required for IPv6 operations is never initialized. If an IPv6 packet is injected into a VXLAN interface, the code later inserts a NULL pointer dereference, leading to a kernel crash and a system halt. This type of failure results in an immediate loss of service for the affected node but does not provide an attacker with direct code execution or data exfiltration capabilities.

All Linux kernel builds that include the VXLAN driver and lack the patch introduced in commit 168ff39e, which add the early NULL check, are vulnerable. The vulnerability would affect any distribution using the upstream kernel before the fix was merged. The affected vendor is Linux, the product is the Linux kernel; no specific patch level information is provided, so any kernel upstream version that predates the change is potentially at risk.

The CVSS score of 5.5 reflects a medium severity, primarily due to the denial‑of‑service nature of the crash. EPSS indicates an estimated probability of exploitation below 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation in the wild. An attacker would need the ability to inject crafted IPv6 packets to a VXLAN interface, which could be achieved through a local or remote network connection depending on system exposure. While the current scoring and lack of exploitation data imply a modest risk, a kernel crash on a production host can have critical operational impacts.