In the Linux kernel, the 6LowPAN implementation contains a NULL pointer dereference in lowpan_newlink(). When a TUN device changes its link‑layer type to ARPHRD_IEEE802154 via TUNSETLINK without initializing ieee802154_ptr, an RTM_NEWLINK request can cause the kernel to dereference a null pointer, leading to a crash. The resulting kernel panic renders the affected host unavailable, representing a denial of service.

The flaw exists in the Linux kernel’s 6LowPAN subsystem and can affect any system that uses a TUN device capable of switching to ARPHRD_IEEE802154. Systems running an unpatched kernel version that includes the bug are susceptible; no specific version range is provided, but the commit that fixed the issue is available in the kernel source control.

The attack requires sending an RTM_NEWLINK request or performing a TUNSETLINK operation, actions that normally demand elevated rights such as root or CAP_NET_ADMIN. This requirement is inferred from normal kernel access controls rather than explicitly stated in the CVE description. The EPSS score is < 1%, indicating a low likelihood of exploitation, while the CVSS score of 5.5 denotes moderate severity. The vulnerability is not listed in CISA KEV, implying no publicly documented exploits. Nevertheless, a successful exploit results in a kernel crash that compromises the availability of the entire system.