The Linux kernel’s ipvlan driver fails to copy the needed_headroom and needed_tailroom values from the underlying physical device during initialization. When a lower device such as macsec, ipsec, wireguard, or a tunnel requires extra headroom or tailroom, packet processing routines that rely on accurate buffer calculations can overrun allocated memory. This can trigger reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes, all of which are consistent with the CWE-124 buffer overflow weakness described in the fixed code.

Any Linux kernel build that contains the ipvlan driver before the patch is applied is vulnerable. This includes all standard distribution kernels and custom builds that have not yet incorporated the commit that inherits needed_headroom and needed_tailroom from phy_dev. Systems running active IPvlan interfaces—regardless of whether they perform tunneling, MACsec, or other encapsulation—fall into this affected group.

The CVSS score of 9.8 reflects a severe impact. The EPSS score of less than 1% indicates a low likelihood of exploitation in the near term, and the flaw is not listed in CISA's KEV catalog. The likely attack vector is remote network traffic sent to an affected IPvlan interface or a local attacker with privileges who can inject crafted packets. An attacker exploiting this vulnerability could cause kernel panics, repeated crashes, or denial of service, effectively exploiting the CWE-124 flaw.