The Linux kernel’s __vlan_insert_inner_tag() routine does not verify that a MAC header of the required length is present before rewriting packet data. This oversight allows an attacker who can inject packets into an IFF_TUN interface to trigger an out-of-bounds read, exposing uninitialized slab memory in outgoing frames. The flaw could leak kernel contents or corrupt packet payloads, potentially leading to crashes or anomalous protocol behavior.

All systems that run recent Linux kernels with the default VLAN handling code and enable IFF_TUN interfaces that can transmit VLAN-tagged traffic are potentially impacted, regardless of distribution or hardware architecture.

Based on the description, the vulnerability could potentially be exploited by an entity that can inject packets into an IFF_TUN interface. This activity typically requires elevated privileges such as CAP_NET_ADMIN, but the CVE description does not explicitly state privilege requirements. The EPSS score of <1% indicates the exploitation probability is low, though the CVSS score of 7.0 reflects a significant impact for potential information disclosure from uninitialized memory. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is documented. Updating to a kernel that enforces MAC header validation removes the flaw, requiring a distribution update or a kernel rebuild and reboot.