In the Linux kernel bonding subsystem, a flaw causes the header parsing routine to recurse without bound when a stack of two bonded network interfaces is configured. Because the packet device reference always points to the top of the hierarchy, the parser repeatedly invokes itself without reaching the leaf, potentially leading to an infinite loop inside the kernel. This flaw falls under CWE‑835, which concerns infinite loops that can serve as denial‑of‑service avenues.

All Linux kernel releases that have not yet incorporated the vendor‑supplied fix are potentially vulnerable. Any distribution that allows users to stack multiple bonded interfaces—common in enterprise switches, virtualized networking, and advanced routing setups—could experience this issue if the configuration hierarchy includes more than one bonding device.

With a CVSS score of 7.5 the vulnerability is considered high severity, yet the EPSS score is below 1 %, indicating a low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploits. The likely attack vector is an intentional or accidental network configuration that creates a bonded‑device stack; an attacker would need the ability to influence or control such a configuration. When triggered, the infinite loop could consume kernel CPU resources, potentially causing a system slowdown or crash, which in turn results in a denial‑of‑service condition.