A single destination cache is shared between the input and output processing paths of the seg6 lwtunnel. When either path runs first it populates the cache, and the second path reuses that cache without performing its own routing lookup. This can let an attacker force the kernel to route packets incorrectly, potentially allowing unauthorized code execution in the kernel or causing a denial of service. The possibility of code execution is inferred, as the description does not explicitly mention it.

The flaw exists in the Linux kernel. Affected releases are kernel 4.10 and the 7.0 release‑candidate series from rc1 through rc7. Any Linux distribution running one of these kernel versions is vulnerable.

The CVSS score of 9.8 indicates a critical severity, but an EPSS score of less than 1 % suggests the likelihood of active exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector may involve local privilege escalation via kernel code execution or manipulation of seg6 traffic; this inference is drawn because the description does not explicitly state the attack path.