The seg6 lwtunnel implementation uses a single destination cache for both input and output packet processing paths. The input and output code paths can perform post‑encapsulation SID lookup in different routing contexts, such as IP rules that match the ingress interface or VRF tables. Whichever path executes first populates the shared cache, and the second path reuses it without performing its own routing lookup. This cache reuse bypasses proper routing context handling and can divert traffic into unintended routing tables. The flaw may allow an attacker to influence kernel routing decisions, potentially leading to unauthorized kernel code execution or denial of service. The weakness relates to Improper Synchronization (CWE‑459) and Broken Cache Isolation (CWE‑821).

The vulnerability exists in the Linux kernel for all 4.10 releases and the 7.0 release‑candidate series from rc1 through rc7. Any system running one of these kernel versions – as identified by the CPE strings for linux_kernel:4.10 and linux_kernel:7.0:rc1‑rc7 – is affected.

The CVSS score of 9.8 classifies the issue as critical, while an EPSS score of less than 1 % indicates a low likelihood of active exploitation at present. The flaw is not listed in the CISA KEV catalog. The attack vector is not explicitly documented; based on the description, it is inferred that a local attacker who can craft segmented IPv6 packets or manipulate routing tables could trigger the cache reuse, potentially resulting in kernel code execution or a denial of service. No public exploits have been reported, so the risk remains largely theoretical until a demonstrable exploit emerges.