The Linux kernel allowed a packet received on an ARPHRD_NONE device, such as a TUN interface, to be processed by key_extract() without verifying that the packet contained at least the expected 14 bytes of Ethernet header data. This omission meant that when the skb->protocol field was set to ETH_P_TEB, the kernel attempted to pull 2×ETH_ALEN bytes for MAC addresses and an additional 2 bytes for the ethertype, which triggered a BUG in __skb_pull() and caused a kernel crash. The result is a denial of service, potentially affecting system availability when a misconstructed packet is received. The likely attack vector involves local or privileged access to inject malformed packets into an ARPHRD_NONE device.

All Linux kernel builds that include the openvswitch network subsystem and support ARPHRD_NONE devices are impacted, including any release that has not incorporated the fix that adds a check_header() call before accessing the Ethernet header. The issue manifests on systems that create or use TUN/TAP interfaces or other devices that expose the ARPHRD_NONE type.

The CVSS score of 7.8 marks this vulnerability as high severity. The likely attack vector involves local or privileged access to inject malformed packets into an ARPHRD_NONE device, after which a crafted packet can trigger a kernel BUG, causing a system crash and resulting in denial of service. The EPSS score is present but below 1%, indicating a very low probability of exploitation in the wild. It is not listed in CISA KEV, so no known widespread exploitation cases exist. Systems exposing TUN/TAP interfaces to untrusted users remain at elevated risk until the bug is addressed.