The vulnerability arises in the Linux kernel’s IPv6 error handling, where an outer IPv4 ICMP error packet is cloned and passed to ip6_err_gen_icmpv6_unreach(). The kernel interprets a field intended for IPv4 as IPv6, enabling an attacker to craft a packet that causes the kernel to read beyond the bounds of the received packet. This out‑of‑bounds read can result in a 16‑byte memory swap that writes past the end of the packet into the skb_shared_info structure, corrupting kernel memory and potentially allowing an attacker to execute arbitrary code with elevated privileges.

All Linux kernel implementations are affected until the patch that clears skb2->cb[] in ip6_err_gen_icmpv6_unreach() is applied. Administrators should verify whether the kernel in use includes the fix by checking the changelog for the kernel version or by matching the commit hash that introduces the clear operation. Custom or custom‑patched kernels should also be examined to ensure the same code path has been updated.

The CVSS score is 9.8. The EPSS score is < 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The risk depends on whether the target system is exposed to crafted ICMPv4 error packets that contain a CIPSO option. An attacker would need to send such a malformed packet over a network that forwards ICMPv4 errors to the host. Although exploitation is not yet demonstrated publicly, the memory corruption could lead to kernel privilege escalation if the attack succeeds.