The Linux kernel’s llc_alloc_frame() function reserves link‑layer headroom based on the device type, but it does not account for the extra VLAN header added by vlan_dev_hard_header(). When an LLC response is processed on a stacked Ethernet device, the resulting skb can underflow its headroom, potentially corrupting kernel memory. This underflow constitutes a buffer underflow (CWE‑119) that can lead to a kernel crash or, if exploited, privilege escalation.

The issue affects all versions of the Linux kernel that contain the llc_alloc_frame() implementation prior to the fix. Any Linux system using stacked Ethernet devices—particularly VLAN interfaces—when receiving LLC responses is susceptible. No specific kernel version numbers are listed, so all distributions should check for the relevant commit and patch release.

The flaw can be exploited by sending crafted LLC responses over VLAN‑capable interfaces, which may trigger the headroom underflow and corrupt kernel memory. No CVSS score is available, so an explicit severity rating cannot be provided. While the EPSS score is not available and the vulnerability is not recorded in the CISA KEV catalog, the nature of the bug suggests a moderate to high risk of denial of service or privilege escalation if an attacker can inject such traffic. The likely attack vector is remote network traffic; however, this inference is made because the flaw is triggered by network‑layer frames and no explicit vector is documented.