The vulnerability is a NULL pointer dereference in the Linux kernel bonding driver that occurs when IPv6 is disabled. If the system boots with 'ipv6.disable=1', the ipv6 netdev common configuration structure is never initialized, yet bonding components still call functions that reference it. This leads to a kernel panic, a single failure that results in a denial of service via a system crash. The weakness corresponds to a classic NULL pointer dereference.

Affected systems are Linux kernel installations that include the bonding module and are booted with 'ipv6.disable=1'. The vendor is Linux; product is the Linux kernel. Systems that load the bonding module and enable the bonding ARP monitor may trigger the vulnerability. No specific kernel versions are listed, so any kernel release containing the unpatched bonding driver remains vulnerable.

Risk assessment is now informed by an EPSS score of <1%, indicating the likelihood of exploitation is very low. Even so, the bug can still cause an immediate kernel crash whenever the bonding ARP monitor is triggered. The flaw is not listed in CISA KEV and no publicly known exploit exists at this time. The likely attack vector remains local configuration: an administrator boots the machine with 'ipv6.disable=1' and configures a bonded interface using a mode that invokes the ARP monitor, such as active-backup. The exploitation requires the specific combination of kernel parameter and bonding configuration, so while the impact is severe—a service interruption—the overall risk remains low due to the low EPSS score. With a CVSS score of 5.5 the vulnerability is rated medium severity.