The Linux kernel’s VXLAN implementation incorrectly uses pskb_may_pull instead of pskb_network_may_pull to verify the presence of network layer headers during packet transmission. Because skb->data points to the MAC header, the checks only examine the bytes immediately following skb->data rather than accounting for the MAC header offset, which can leave portions of the network header in non‑linear fragments. This out‑of‑bounds read scenario (CWE‑125 and CWE‑805) could lead to kernel instability or crashes if malformed VXLAN packets are processed.

All Linux kernel environments compiling with the VXLAN module are potentially affected; the problematic logic exists in any kernel version prior to the application of the referenced fixes. No specific version ranges are enumerated in the advisory, so any kernel incorporating VXLAN support before the patch may be vulnerable.

The CVSS score of 9.8 signals a high severity vulnerability, while the EPSS score of <1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Remote attackers may be able to trigger the issue by sending crafted VXLAN packets to the vulnerable host, which is inferred from the nature of the bug but not directly stated in the official description. No publicly known exploit is documented.