The Linux kernel’s VXLAN implementation contains a flaw in the route_shortcircuit() routine, which uses pskb_may_pull() relative to skb->data. This miscalculates the number of bytes that must be present in the linear buffer, allowing the code to read beyond the pulled network header when handling VXLAN packets. The over-read can expose kernel memory contents or cause a kernel panic, providing confidentiality or availability impact.

All Linux kernel deployments that include the unpatched VXLAN code are affected. The CVE does not list specific kernel versions, so any build that relies on the legacy route_shortcircuit() logic is considered vulnerable until the patch that switches to pskb_network_may_pull() is applied.

The EPSS score is < 1 %, indicating a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 9.8 reflects a high severity. The likely attack vector is via traffic processed by the VXLAN stack – an attacker able to inject crafted VXLAN packets into the host, either over the physical network or through virtual interfaces, could trigger the fault. This is an inferred assessment based on the description, as the precise exploit path is not detailed in the CVE data.