The flaw exists in the Linux kernel's IPv6 tunnel code, where an uninitialized value is read during the decapsulation of IPv6 packets. This occurs because the routine that prepares the packet for decapsulation fails to account for VLAN encapsulation, leading to the use of skb_vlan_inet_prepare() instead of pskb_inet_may_pull(). The result is potential corruption of kernel memory or an immediate crash, which would manifest as a denial of service on the host that processes the malformed packets. Based on the description, it is inferred that the uninitialized value leads to kernel panic during packet processing, causing a loss of availability.

Affected are Linux systems running kernel 6.8 and the 6.19 release‑candidate series (RC1 through RC8). The vulnerability resides in the __ip6_tnl_rcv() path that handles inbound IPv6 tunnel traffic. Installing a kernel version that incorporates the commit replacing the pull routine with skb_vlan_inet_prepare() resolves the issue.

The CVSS score of 7.5 denotes high impact, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of reporting. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to send specially crafted IPv6 packets containing VLAN tags to a target system capable of processing tunnel traffic. If successful, the flaw can cause a kernel panic, leading to a denial of service. No other attack vectors or preconditions are documented in the supplied data. Based on the description, the likely attack vector is the transmission of specially crafted IPv6 packets that embed VLAN tags to a host that handles IPv6 tunnels, which does not require admin rights on the target.