The vulnerability is a null-pointer dereference in the Linux kernel bridge driver that occurs when VLAN filtering is disabled and the BR_BOOLOPT_FDB_LOCAL_VLAN_0 flag is toggled through netlink. This dereference brings the kernel to a general protection fault, resulting in a system crash and a reboot, which is a denial of service attack.

Linux kernel versions that ship with the bridge driver compiled without CONFIG_BRIDGE_VLAN_FILTERING and that do not include the newly added NULL checks are affected. The bug can be triggered on any distribution that uses the default kernel bridge implementation and creates or modifies a bridge interface with the BR_BOOLOPT_FDB_LOCAL_VLAN_0 option via RTM_NEWLINK.

The CVSS score of 5.5 indicates a medium severity vulnerability, but the EPSS score of <1% shows a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. An attacker would need to invoke netlink commands on the host, which usually requires local root or equivalent privileges; this requirement is inferred from the need to create or modify bridge interfaces. Once the capability is present, the exploit simply toggles the flag and the kernel crashes, resulting in a denial of service.