The tap driver incorrectly sets the transport_header when processing VLAN-tagged frames. During packet transmission, skb_set_network_header is called before skb_probe_transport_header, causing the network_header to point past the VLAN tag to the inner protocol header while the protocol field remains set to ETH_P_8021Q. The subsequent dissector misinterprets the inner Ethernet header as a VLAN header, leaves transport_header uninitialized, and the packet is delivered with an invalid transport layer protocol. This misparsing can interfere with normal packet handling, potentially leading to corrupted packet processing or a denial of service for applications that use the affected tap interface. The CVE description does not explicitly confirm a kernel crash, only that incorrect headers may result, so the risk is limited to functionality disruption rather than guaranteed crash.

All Linux systems that run a kernel containing the tap driver and expose a tap interface are susceptible. The issue is present in every kernel release prior to the patch commit that corrects the header handling, regardless of distribution or kernel version number.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation to date. An attacker capable of injecting crafted VLAN-tagged frames into a reachable tap interface—either locally or remote if the interface is exposed—could trigger packet processing failure and cause a denial of service. Because the misinterpretation occurs only when the probe function is invoked with the incorrect network_header placement, the attack requires a specific packet format and may be challenging to trigger reliably. Overall, the risk level can be considered moderate, with the primary impact being service disruption rather than privilege escalation or data exfiltration.