An unsigned integer underflow occurs in the Linux kernel’s GARP attribute parser when computing the data length of a received attribute. The kernel subtracts the attribute length from the header size, which can underflow for attributes that include data, yielding an incorrect small length. The bad length is truncated to an 8‑bit field and causes garp_attr_lookup() to misalign the parsed data, so many legitimate Join/Leave GARP messages are discarded. The effect is a denial of service to the GARP receive path, preventing normal VLAN registration and topology discovery that rely on GARP VLAN registers. The flaw does not allow arbitrary code execution or privilege escalation.

All Linux kernel releases that do not include the patch which corrects the unsigned integer underflow in garp_pdu_parse_attr are vulnerable. This includes any distribution kernel that is prior to the incorporation of that specific fix. Users should verify that their kernel version contains the commit that corrects the length‑calculation logic in the GARP attribute parser.

The CVSS base score of 5.5 indicates moderate severity. The EPSS score is less than 1%, suggesting that the probability of real‑world exploitation is extremely low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require a local or network neighbor that can send crafted GARP packets and would only affect GARP‑dependent network services; it does not provide code execution or privilege escalation capabilities. Therefore the overall risk is moderate but actionable.