The vulnerability resides in the Linux kernel's VXLAN VNI filter entry policy. The GROUP and GROUP6 attributes are declared with only a maximum length, allowing an attacker to send a shorter payload that passes validation. When the consumer reads the attribute unconditionally, it over‑reads up to three bytes of uninitialised memory. These bytes are stored into a remote_ip field and returned through RTM_GETTUNNEL, thereby exposing kernel memory contents. The impact is a local kernel memory disclosure that can leak sensitive data.

All Linux kernel installations that include the VXLAN VNI filter entry policy with GROUP and GROUP6 attributes are affected. The vendor identifiers list only the Linux kernel, and no specific version ranges are included, meaning that affected kernels include those built from the unpatched code base in the many distribution repositories.

The CVSS score is not provided, but the vulnerability can be leveraged by an attacker who can form netlink messages to query VXLAN filter entries, such as a local user with sufficient privileges. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation. However, the local nature of the exploit means that an attacker with elevated privileges can easily trigger the read and retrieve kernel memory. The lack of mitigation in unpatched kernels results in a moderate to high risk for systems that expose the VXLAN netlink interface.