An integer overflow occurs in the IPv6 sendmsg path, where a 16‑bit length counter accumulates option sizes without bounds checking. When many large destination‑options are provided, the counter wraps from 65535 to a small value (CWE‑190). The subsequent use of the wrapped counter in headroom calculations causes skb_push to underflow and trigger a kernel panic (CWE‑617). The result is a local denial of service that brings the entire system down. The vulnerability is an integer overflow that leads to a crash.

The weakness exists in the Linux kernel’s IPv6 networking code. All Linux distributions that ship an affected kernel version are potentially vulnerable; however, no specific kernel release list is provided in the advisory, so the exact impacted versions remain unknown.

The reported CVSS score of 5.5 marks it as moderate severity, and the EPSS score is < 1%, indicating a low probability of exploitation. The bug can be triggered by a task that has CAP_NET_RAW in the relevant namespace, a capability that root or a user with the ability to create user‑namespace pairs can acquire. Consequently, any user who can instantiate a user namespace with network namespace capabilities can exploit the flaw, leading to a panic and system reboot. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, but the local nature of the attack and lack of publicly available mitigations mean that patching remains the most reliable defense.