The vulnerability resides in the Linux kernel L2TP subsystem. When a tunnel or session is created or modified, the kernel sends a multicast notification to interested listeners. The notification helper may fail when allocating, encoding, or sending the message, yet the old code returned this best‑effort failure as the command result. Consequently, a caller that interprets the result as a failure may retry the operation even though it has already completed successfully. Repeated retries can create duplicate tunnels or sessions and gradually exhaust kernel resources, leading to degraded performance or a denial‑of‑service condition. No code execution or privilege escalation is directly provided by this flaw.

All Linux kernel builds that contain the stock L2TP code and have not yet incorporated the commit that suppresses propagating notification errors are affected. The advisory does not list specific kernel versions, so users should verify whether their running kernel includes the change or a backward compatible patch. The flaw applies across distributions that ship the standard upstream kernel.

The CVSS score of 4.4 indicates a low overall severity. Exploitation requires that the attacker be able to send netlink commands to the kernel, which typically means local or privileged access, or the presence of another vulnerability that permits such interaction. EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation prevalence. Based on the description, it is inferred that the attacker would need to interact with the L2TP subsystem via netlink, requiring at least local privileged access or another vulnerability to gain that capability. The flaw does not provide remote code execution or privilege escalation by itself but can be leveraged to cause resource exhaustion and service disruption through repeated retries.