The vulnerability is a logic flaw in the netfilter ip6t_rt module of the Linux kernel. When a rule is installed, the number of addresses (addrnr) is not validated. An attacker can supply an oversized addrnr that exceeds the IP6T_RT_HOPS limit, causing rt_mt6() to read beyond the bounds of the address array. This out-of-bounds read can trigger a kernel panic, resulting in a system crash and denial of service. The weakness is identified as the out-of-bounds array access described by CWE-1284.

The flaw appears in all Linux kernel builds that ship with the ip6t_rt match module before the patch is applied. The CVE data does not list specific kernel releases, so any unpatched kernel running this module is potentially vulnerable. This includes mainstream distributions featuring the default kernel as well as custom or older kernels that still include the match module.

The CVSS score of 7.1 places the vulnerability in the moderate-to-high severity range. The EPSS score indicates a very low likelihood of exploitation (<1%). The CVE is not listed in the CISA KEV catalog, suggesting no known widespread active exploits. The likely attack vector involves the ability to create or modify iptables rules that use the rt module. This requirement is inferred from typical privilege needs for iptables manipulation and is typically a local privilege scenario. As a result, the vulnerability can be exploited to crash the system when an attacker with sufficient privileges installs a malformed rule, but it does not appear to provide remote code execution or broad privilege escalation.