The Linux kernel’s neighbour subsystem accepts a parameter called NDTPA_INTERVAL_PROBE_TIME_MS from the netlink interface. The module fails to enforce pre‑defined limits and omits validation, allowing an attacker to supply values beyond the intended range. When a 64‑bit integer is converted to a 32‑bit duration using msecs_to_jiffies, large or negative values are silently truncated or sign‑extended. This causes kernel timers to expire instantly, never, or repeatedly, which can flood the timer wheel, exhaust resources, and effectively deny service. The flaw is an instance of improper input validation and unchecked integer conversion. The vulnerability is classified as CWE-1284.

Affected systems are all Linux distributions that ship with a kernel version prior to the commit adding min/max enforcement to NDTPA_INTERVAL_PROBE_TIME_MS. The specific version ranges are not disclosed, so any kernel image that lacks the patch – effectively any non‑updated kernel – is potentially vulnerable. The vulnerability is tied to the Linux kernel's neighbour module and can be triggered via netlink commands on the system.

Exploitation requires local privileges equivalent to CAP_NET_ADMIN or root, as the attacker must send netlink commands that set the interval. The EPSS score is reported as less than 1 %, indicating a very low likelihood of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Once triggered, the incorrect timer handling can lead to a denial of service condition for the host, but the attack surface remains local. The CVSS score of 5.5 indicates moderate severity and the EPSS <1% suggests a low likelihood of exploitation in the wild.