The vulnerability arises in the Linux kernel’s handling of virtual local area network (VXLAN) neighbor information. The existing arp/neigh_reduce routine reads the neighbor high‑address (neigh ha) directly while that structure may be concurrently updated by another kernel thread. This can lead to partial, out‑of‑date reads of the address, which in turn may cause incorrect neighbor resolution or subtle corruption of network state. The flaw is a classic data‑race condition that could undermine the integrity of the network stack and, if exploited, could lead to denial‑of‑service behaviors such as packet drops or network congestion. The kernel developers mitigated the issue by replacing the direct read with a stable snapshot obtained via neigh_ha_snapshot, mirroring the safeguards used in route_shortcircuit processing.

All Linux kernel builds prior to the inclusion of the neigh_ha_snapshot fix are affected. The vendor list is limited to the Linux kernel itself; no specific distribution version range is provided, so any user deploying an unpatched kernel must consider the vulnerability present. It does not appear to be limited to a particular kernel release or configuration.

The EPSS score for this vulnerability is below 1%, indicating a very low probability of active exploitation at present. The flaw is not logged in CISA’s KEV catalog. The absence of a CVSS score in the supplied data means the severity can only be inferred from the nature of the race condition; however, potential impacts on network reliability suggest a moderate severity assessment. Because the flaw requires concurrent kernel activity on the same machine, an attacker would typically need local privilege or the ability to hijack kernel execution to trigger exploitation. Overall, while the risk is not negligible, it is unlikely to be widely exploited under current threat scenarios.