The vulnerability lies in the ebtables component of the Linux kernel, where the system fails to verify that a module name string is null‑terminated before passing it to request_module(). This omission can cause the kernel to receive an improperly terminated string and may lead to unintended module loading or kernel memory corruption. The description does not explicitly state that arbitrary execution is guaranteed; however, the flaw could compromise kernel integrity or stability.

All Linux kernel releases that contain the ebtables module without the added null‑termination check are susceptible. No specific kernel version range is listed, so any system running an unpatched kernel incorporating ebtables can be affected.

The CVSS score of 7.1 reflects a high severity due to the potential impact on kernel integrity, while the EPSS score of <1% suggests a very low current probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector would involve manipulating ebtables to supply a non‑terminated module name, which typically requires privileged access or an additional vector that allows influencing netfilter rule configuration.