A stack buffer overflow occurs when handling error messages for IPv4-over-IPv6 tunnels. The error path clones a packet, leaving its control block formatted as IPv6, but subsequent code interprets it as IPv4. The mis‑alignment permits an attacker to control the length field and copy more bytes into a 40-byte stack buffer, enabling arbitrary code execution on the kernel.

All Linux kernel builds prior to the fix that clears skb2->cb[] and adds minimal IPv4 header validation are vulnerable. The issue appears on any architecture where the ip6_tunnel subsystem is enabled.

The CVSS score of 9.8 indicates critical severity. The EPSS score indicates a low but nonzero exploitation probability (<1%) and the vulnerability is not listed in CISA’s KEV catalog, so no widespread exploits are known yet. The attack vector is network‑based; an adversary can send crafted IPv4‑in‑IPv6 packets to any exposed IP address, triggering the overflow without authentication or special privileges.