lapbeth_data_transmit() assumes the underlying device type is ARPHRD_ETHER; if a device of a different type triggers a NETDEV_PRE_TYPE_CHANGE event without proper handling, the function may operate on invalid data, potentially leading to kernel crashes or denial of service. The fix ensures that the bonding driver returns NOTIFY_BAD, preventing the breach of this assumption.

The flaw is in the Linux kernel’s lapbether networking driver. All distributions shipping a kernel that includes the lapbether code are potentially affected. No specific kernel version numbers are listed, so any system running a kernel before the commit that applies the patch should be treated as vulnerable.

Because EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, no exploitation probability or formal severity score is provided. The absence of a CVSS score means the formal severity assessment is unknown, but kernel networking bugs typically pose high risk if successfully exploited. Caution is advised while a patch is applied.