The Linux kernel function get_upper_ifindexes() writes indices of upper network devices into an array without enforcing a boundary check. Callers assume the number of upper devices never exceeds the maximum, MAX_NEST_DEV, and allocate an array of size 1+MAX_NEST_DEV on the stack. In practice, the count can be larger—especially with many virtual interfaces such as macVLANs—leading to a stack‑out‑of‑bounds write. Based on the description, this memory corruption could destabilize the kernel or lead to privilege escalation if an attacker can influence the redirect path of an XDP program. The likely attack vector involves a local or privileged user loading a BPF program that uses the BPF_F_BROADCAST and BPF_F_EXCLUDE_INGRESS flags on a device with many upper interfaces, then sending traffic to trigger the faulty redirect logic.

Affected systems include any Linux kernel builds that contain the unpatched implementation of get_upper_ifindexes() and its callers. The specific kernel versions are not enumerated in the advisory, so all kernels upstream of the fix commit are considered vulnerable. The CVE references Linux:Linux for the affected vendor and product. The assumption that the vulnerability only applies to kernels with XDP programs attached to devices that host many macVLANs is inferred from the reproduction steps; however, any system capable of creating such a configuration would be at risk.

The CVSS score of 5.5 reflects moderate severity, while the EPSS score of less than 1 % suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely exploitation scenario requires the attacker to have the ability to load a BPF program with specific flags and to configure a device with more than eight upper interfaces; this indicates a local or privileged attack surface rather than a remote vector. The attack can lead to a denial of service by crashing the kernel or, in a more advanced scenario, to privilege escalation through kernel memory corruption.