The vulnerability is a null pointer dereference in the Linux kernel bridge driver that occurs when VLAN filtering is disabled and the BR_BOOLOPT_FDB_LOCAL_VLAN_0 option is toggled through netlink. The buggy code reaches functions that iterate over a vlan group pointer that is NULL, causing an immediate kernel fault and a system reboot. The impact is a denial of service, as any crash results in loss of service and potential system downtime. No evidence of privilege escalation or data compromise is provided in the description.

All Linux kernel versions that ship with the bridge driver compiled without CONFIG_BRIDGE_VLAN_FILTERING and that do not include the patched NULL checks are affected. The vulnerability can be triggered on any distribution that uses the default kernel bridge implementation and that creates a bridge interface with the BR_BOOLOPT_FDB_LOCAL_VLAN_0 flag via RTM_NEWLINK.

Because the crash requires only the ability to create or modify a bridge interface, privilege requirements are limited to local root or an attacker with the capability to run netlink commands. The vulnerability is not listed in CISA KEV catalog and EPSS data is unavailable, but the severity of a kernel crash is high. The exploit is straightforward once the required capability is achieved; thus the risk is considered high for systems that enable bridge functionalities without the VLAN filtering option.