The vulnerability arises in the Linux kernel bonding module (alb_determine_nd) where an uninitialized transport header is accessed during packet transmission or forwarding. This can lead to an out‑of‑bounds read of kernel memory, potentially exposing sensitive data or causing a kernel crash. The weakness is rooted in the assumption that skb->transport_header is always set, which is not true for packets sent via AF_PACKET, raw sockets, or forwarded traffic.

Linux kernels on any distribution that ship the bonding module, with no specific version range listed in the advisory. The issue affects all builds of the Linux kernel that implement the bonding driver with the alb algorithm.

The CVSS score is not provided and EPSS is unavailable, but the lack of CWE severity rating suggests moderate risk. Exploitation would require an attacker to craft malicious packets that traverse the bonding interface, which can be achieved from a local or network attacker with sufficient privileges. The potential outcomes include kernel crashes or unintended disclosure of kernel memory contents. The vulnerability is not yet listed in CISA’s KEV catalog, indicating no known large‑scale exploit activity, yet the class of memory corruption in a critical kernel component warrants rapid mitigation.