A malformed Neighbor Discovery (ND) option can cause the Linux kernel bridge code to read beyond the intended option data or to treat an incomplete source link‑layer address as a full Ethernet address. This out‑of‑bounds read or write corrupts kernel memory and allows an attacker who can inject custom Ethernet frames over a bridged interface to execute arbitrary code with kernel privileges.

The flaw exists in the generic bridge driver that ships with all Linux kernel builds. Kernels that do not contain the patch introduced in the commits referenced in the advisory are vulnerable. Distributions still shipping older kernel versions remain exposed until they upgrade to a kernel that includes the validation fix.

The CVSS score of 5.5 indicates a moderate severity, reflecting the memory corruption that can lead to elevated privileges but is not guaranteed for arbitrary code execution without additional conditions. The EPSS score of <1% indicates a low probability of exploitation observed in the wild. The vulnerability remains unlisted in the CISA KEV catalog. Exploitation would require an attacker to inject specially crafted Neighbor Discovery options onto a bridged Ethernet interface; if successful, the kernel could read or write beyond the intended bounds, potentially escalating privileges. The lack of a KEV listing and low EPSS suggest that active exploitation is not widespread, but administrators should still prioritize applying the kernel patch.