The vulnerability occurs in the Linux kernel’s VXLAN implementation where the metadata pointer _md is left uninitialized when a VXLAN device uses both VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP but the external ip_tunnel_info lacks the IP_TUNNEL_VXLAN_OPT_BIT flag. The uninitialized pointer causes vxlan_build_gbp_hdr() to read garbage data, which can inadvertently set VXLAN header flags, manipulate GBP fields such as dont_learn and policy_applied, and expose 16 bits of kernel stack data over the network. This results in information leakage and potential traffic manipulation, compromising confidentiality and integrity of VXLAN traffic.

Affected systems: Linux kernel. No specific version range is listed in the CVE data. Hosts running a Linux kernel with VXLAN support and configured with both VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP are potentially affected.

The CVSS score is not provided, and EPSS is unavailable, indicating limited publicly known exploitation data. The attack vector is inferred to be remote and network-based, requiring an attacker to send crafted VXLAN packets to a vulnerable host. Since the bug manifests during packet processing, it would be exploited by an attacker who can inject malicious VXLAN frames, potentially leaking kernel data and gaining control over VXLAN header flags. No official exploit is documented, and the issue is not listed in CISA’s KEV catalog, suggesting a lower but non-negligible risk compared to higher severity vulnerabilities.