A time‑of‑check to time‑of‑use race in the Linux kernel’s VXLAN module allows an attacker to cause an out‑of‑bounds write when the kernel constructs a neighbor reply. The race arises because vxlan_na_create() reads the required headroom twice, once for buffer allocation and once for headroom reservation; a concurrent vxlan_changelink() call can alter the value between those reads. If the second value is larger, the Ethernet header is written beyond the allocated buffer, corrupting kernel memory and potentially leading to a system crash or compromise.

All Linux kernels that contain the vulnerable vxlan_na_create() implementation before the latest patch are affected. This includes every distribution that ships with the default kernel code for VXLAN support; specific sub‑versions are not enumerated, so any unpatched kernel running the outdated code is susceptible.

The CVSS v3.1 score of 4.7 indicates moderate severity, while the EPSS score of less than 1% suggests low likelihood of widespread exploitation. Because the flaw can be triggered by network‑based VXLAN traffic while a local administrator changes link settings, the theoretical attack vector is limited to environments that both send and receive VXLAN packets. Although the vulnerability is not yet listed in the CISA KEV catalog, the reproducible out‑of‑bounds write could crash the kernel or, if an attacker can influence the surrounding memory, potentially lead to denial of service or privilege escalation.