br_nd_send() in the Linux kernel parses neighbour discovery options directly from the packet buffer, assuming that the options reside in the linear part of the skb. The callers only guarantee that the ICMPv6 header and target address are linear, leaving the option area potentially non‑linear. When this assumption is violated, parsing ns->opt[] can read past the linear buffer, resulting in an out‑of‑bounds read or write that corrupts kernel memory. The flaw is classified as CWE‑788 and carries a CVSS score of 9.1, indicating a high‑severity weakness that could compromise kernel integrity.

All Linux kernel builds that include the bridge module and the br_nd_send function are potentially affected. The vulnerability is present before the fix referenced in the listed git commits, and no specific version constraints are provided, so any kernel older than the fixed commit is at risk, including the 7.0 release candidates (rc1–rc6) identified in the CPE list.

The CVSS score of 9.1 reflects a severe vulnerability, yet the EPSS score is less than 1% and the bug is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. The likely attack vector is a network‑based exploit targeting the bridge interface with crafted ICMPv6 neighbour discovery packets that place options beyond the linear packet area. Based on the description, an attacker could trigger the flaw by sending such packets to a bridged host, potentially leading to kernel memory corruption, crashes, or in some scenarios, privilege escalation.