The Linux kernel’s bridge VLAN subsystem contains a bug where a switchdev deletion error causes the VLAN deletion routine __vlan_del to abort early. This abort path leads to inconsistent internal state, memory leaks during bridge flushing, and a NULL pointer dereference when the bridge module logs an error. The dereference results in a kernel panic and loss of networking services, potentially forcing a system reboot.

All Linux kernel builds that include the buggy bridge VLAN handling and have not yet applied the patched code are affected. This includes standard kernel packages delivered by major distributions and any custom builds that compile the unmodified bridge code. The vulnerability is present regardless of kernel release number as long as the offending __vlan_del logic is present.

The EPSS score of < 1% suggests a very low exploitation probability, while the CVSS score of 5.5 indicates moderate severity. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to be able to configure or delete a VLAN on a software bridge; this could be achieved locally with bridge utilities or remotely if bridge management services are exposed. Successful exploitation would trigger a kernel crash, resulting in denial of service. No additional privileges or isolation constraints are explicitly noted, so the bug could be triggered by any user with bridge configuration rights.