In the Linux kernel, a flaw in the vxlan_na_create function allows a specially crafted VXLAN packet to cause the kernel to read or write memory beyond the intended bounds of the ND options area. The bug occurs because the implementation does not validate that each option length fits within the remaining space, nor does it verify that a source LLADDR option is long enough to hold an Ethernet address. When an attacker sends a malformed VXLAN packet containing an oversized or undersized option, the kernel can advance past the correct boundary or access an incomplete address, leading to a buffer overflow that can crash the kernel or be leveraged for arbitrary code execution. The flaw is a classic out‑of‑bounds memory access associated with CWE‑1284.

Linux kernel on any system that has the vxlan module enabled before the patch. The affected vendor is Linux, the product is the Linux kernel, but no specific version list is provided. The fix is included in recent kernel releases (the commit range can be found in the kernel source history). Systems that run older kernel versions are potentially vulnerable if they continue to use VXLAN tunnels from untrusted peers.

The vulnerability is exploitable via network traffic; an attacker who can send malicious VXLAN packets can trigger it. The EPSS score is not available. The CVSS score of 7.0 indicates high severity, reflecting potential privilege escalation to root. The vulnerability is not yet listed in the CISA KEV catalog, but its kernel context warrants careful attention.