A flaw in the IPv6 sendmsg path makes the kernel accumulate an option length into a 16‑bit counter while later using a pointer to the last provided destination‑options header without checking for overflow. When enough large options are supplied, the length counter wraps back to a small value while the actual header remains large, causing the skb push operation to use too little headroom and trigger a kernel panic through skb_under_panic. The result is a local denial of service that brings the entire system down. The vulnerability is an integer overflow that leads to a crash.

The weakness exists in the Linux kernel’s IPv6 networking code. All Linux distributions that ship an affected kernel version are potentially vulnerable; however, no specific kernel release list is provided in the advisory, so the exact impacted versions remain unknown.

The reported CVSS score of 5.5 marks it as moderate severity, and the EPS score is not available, so exploitation likelihood cannot be quantified precisely. The bug can be triggered by a task that has CAP_NET_RAW in the relevant namespace, a capability that root or a user with the ability to create user‑namespace pairs can acquire. Consequently, any user who can instantiate a user namespace with network namespace capabilities can exploit the flaw, leading to a panic and system reboot. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, but the local nature of the attack and lack of publicly available mitigations mean that patching remains the most reliable defense.