The vulnerability occurs in the Linux kernel's bridge networking code. When IPv6 is disabled via the kernel boot parameter, the nd_tbl structure is never initialized. If Neighbor Discovery suppression is enabled and an ICMPv6 Neighbor Discovery packet is processed by a bridged interface, the code dereferences a NULL nd_tbl pointer, triggering a kernel NULL pointer dereference and an Oops crash. This results in a denial of service by crashing the kernel and requiring a reboot, exemplifying a CWE‑824 weakness.

All Linux kernel installations that include the bridge networking subsystem are potentially affected when IPv6 is disabled and Neighbor Discovery suppression is enabled. No specific versions are listed, so any kernel version compiling the upstream bridge code at the time of this vulnerability could be impacted until the fix is applied. Distributions that ship kernel packages must ensure that the updated kernel is deployed to users running a bridged network configuration with IPv6 disabled.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not currently catalogued in CISA’s KEV list. Exploitation requires that the bridged system receives an ICMPv6 Neighbor Discovery packet, which could be triggered by legitimate network traffic when IPv6 is partially enabled or by a crafted packet if the system processes such traffic. Because the flaw results in a kernel crash rather than privilege escalation, the focus is on preventing service interruption. The official fix replaces the compile-time check with a runtime check, effectively disabling Neighbor Suppression when IPv6 is disabled.