The defect occurs in the Linux kernel’s VLAN stack where insufficient headroom is not pre‑allocated for VLAN headers. Callers that reserve only the Ethernet header size or skb objects created before dynamic headroom changes may touch vlan_dev_hard_header() with inadequate space, leading the kernel to invoke skb_under_panic(). This behavior can cause a kernel panic and reboot, breaking availability and potentially exposing the system to further attacks if the panic cannot be avoided.

All versions of the Linux kernel that include the VLAN driver without the described protection are affected. The change was included in later stable releases and the concern applies to configurations that use VLAN stacking, reorder headers, or dynamic device feature toggles such as bonding or team switches.

Exploitability data is currently unavailable; the CVE is not listed in the CISA KEV catalog, and no EPSS score is provided. However, the nature of the flaw—directly triggering a kernel panic—implies a high potential impact if an attacker can exercise code paths that invoke vlan_dev_hard_header() with insufficient headroom. The vulnerability may be triggerable by local users or processes with network capabilities, so it is prudent to treat it as high risk until the patch is applied. Based on the description, it is inferred that an attacker could trigger the kernel panic by sending crafted packets that cause vlan_dev_hard_header() to run with insufficient headroom, implying a local or network-level attack vector.