The Linux kernel’s iptunnel_xmit_stats() function incorrectly assumed all tunnel interfaces used NETDEV_PCPU_STAT_TSTATS, but VXLAN and Geneve tunnels use NETDEV_PCPU_STAT_DSTATS. On 32‑bit kernels the differing offset between pcpu_sw_netstats and pcpu_dstats can overwrite the syncp sequence, leading to memory corruption and a system freeze. This results in a denial‑of‑service condition that can be brought on by traffic sent over the affected tunnels.

Any system running a Linux kernel version prior to the inclusion of the iptunnel patch is susceptible. The issue is most severe on 32‑bit architectures, but any kernel exposed to VXLAN or Geneve traffic without the patch could experience statistics corruption, regardless of vendor kernel build.

The CVSS score is not supplied, but the nature of the memory corruption indicates a high‑impact flaw. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog. Inferred likely attack vectors involve an attacker who can send traffic over VXLAN or Geneve interfaces to the host, either from inside the network or from an external source capable of reaching the tunnel endpoints. Successful exploitation would result in a crash or hang, disrupting availability.