The flaw is a NULL pointer dereference that occurs in the bonding driver’s IPv6 packet handling when the kernel is booted with IPv6 disabled. Because the nd_tbl data structure is never initialized under this configuration, an incoming IPv6 Neighbor Solicitation or Advertisement packet processed by the bonding driver can trigger bond_validate_na(), which calls ipv6_chk_addr(). This ends up crashing in __ipv6_chk_addr_and_flags(), producing a kernel Oops and a system crash. The crash results in an immediate denial of availability. The weakness corresponds to a classic NULL pointer dereference, a scenario described by CWE‑824.

Any Linux kernel that supplies the bonding driver and is configured with bonding ARP/NS validation enabled while IPv6 is disabled via the ipv6.disable=1 boot parameter is affected. No specific kernel version range is provided, so the flaw may exist in all affected releases that support this configuration.

The EPSS score is <1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, but the impact is clear. The CVSS score of 7.0 indicates a high severity. The crash can be triggered by an attacker who can deliver an IPv6 Neighbor packet to a bonded interface on the target machine. If the bonded interface is reachable from an external network, this is a remote exploit that requires no privilege. The potential for an unprivileged, network‑based attacker to cause a kernel panic makes the risk moderate to high due to the availability impact. Based on the description, it is inferred that the attacker would send forged IPv6 Neighbor packets to the interface; the likely attack vector is a network‑based injection of such packets.