The bug in the Linux kernel causes the IPSKB_L3SLAVE flag to remain unset when SRv6 packets undergo IPIP decapsulation on interfaces that belong to a VRF. As a result, sockets bound to these VRF‑enslaved interfaces do not receive the decapsulated packets, while sockets that are not bound still do. This behavior violates the expected VRF isolation guarantee and can lead to the loss of legitimate traffic and possible denial‑of‑service conditions for services that rely on VPN decapsulation.

All Linux kernels that include SRv6, VRF, and IPIP decapsulation support are affected until the patch that correctly sets the flag is applied. This includes mainstream distribution kernels that have not yet incorporated commit 44930446dde4, as well as custom kernels that use these features.

The vulnerability is scored 7.0 on CVSS, has an EPSS score of less than 1%, and is not listed in the CISA KEV catalog. It can be exploited remotely when an attacker can inject crafted SRv6/IPv6 traffic that triggers IPIP decapsulation on a VRF‑enslaved interface. The likely attack vector, inferred from the packet handling code path, is network‑based packet injection; the description does not explicitly state the vector, so this inference is based on the affected code. The risk is substantial due to the potential for service disruption and violation of VRF isolation, though the vulnerability does not provide code execution or data compromise.