A flaw in the Linux kernel’s XFRM layer causes the size of a netlink event message to be miscalculated when an interface identifier is present. This oversight allows the build process to fail, triggering an unconditional BUG_ON that culminates in a kernel panic. The result is a denial of service whereby a malformed netlink request can bring the system offline. The vulnerability stems from improper input validation and missing message size accounting, leading to a catastrophic kernel failure. In practice, an attacker who can craft such a netlink payload – potentially a privileged user or an application with CAP_NET_ADMIN – can exploit this flaw to destabilize the host. The documented fix removes the BUG_ON and adds proper error handling, thus preventing the panic.

All Linux kernel releases earlier than the commit that adds XFRMA_IF_ID to the event size calculation are affected. The fix appears in the kernel commit series referenced by the advisory links, specifically the commit identified by hash e62e322ea20be78e346e4b49f9a6b9f03313af4c. No specific version numbers are listed, so any deployment running an unpatched kernel is vulnerable.

EPSS is less than 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity due to the potential for a kernel panic. The likely attack vector is a local user with netlink privileges, requiring CAP_NET_ADMIN or root to send the crafted message. The CVE description does not state that users with limited privileges can exploit this flaw; any such capability would depend on additional vulnerabilities or misconfigurations. Once exploited, the system will reboot or halt, leading to an outage. The risk is therefore significant in environments where the XFRM subsystem is active and the kernel cannot be updated promptly.