An oversight in the Linux kernel’s macvlan driver causes the driver to miss inheriting the needed_headroom and needed_tailroom values from the underlying network device during initialization; as a result, when lower‑layer protocols such as macsec, ipsec, wireguard, tunnels or virtual Ethernet adapters prepend headers or trailers to packets, the kernel fails to reserve sufficient memory space. This shortfall can trigger excessive memory reallocation, headroom underflow, or a KASAN slab‑use‑after‑free crash, leading to kernel panics or denial‑of‑service. The flaw is a memory‑handling weakness that satisfies the criteria of CWE-119 (Incorrect Access to Boundary) and CWE-122 (Heap‑based Buffer Overflow).

All Linux kernel implementations that include the macvlan networking module are affected, regardless of vendor. The flaw remains present in every kernel release that does not incorporate the commit that inherits needed_headroom and needed_tailroom values; no explicit version list is provided in the advisory.

Because the vulnerability manifests whenever network packets traverse a macvlan interface that is bound to a lower‑layer device requiring additional headroom or tailroom, the likely attack vector is network traffic sent to such a macvlan‑attached device; this inference is drawn from the description that the issue arises during dev_hard_header() or macvlan_hard_header() operations. No EPSS score is available and the flaw is not listed in the CISA KEV catalog. While an official CVSS score is not supplied, the high‑severity impact of kernel crashes or KASAN errors indicates significant risk; any attacker capable of sending crafted packets to the target can potentially trigger a denial‑of‑service or, in the presence of additional vulnerabilities, escalated privileges.