The vulnerability in the Linux kernel's IOAM6 subsystem allows an out‑of‑bounds array access when trace->type.bit6 is set. The code calls skb_get_tx_queue() without clamping the index, so a packet arriving on the ingress device’s RX path can be mapped to a TX queue index that exceeds dev->num_tx_queues of the egress device. This can corrupt memory in the dev->_tx[] array, potentially leading to a system crash or arbitrary code execution. Additionally, a missing lock around qdisc_qstats_qlen_backlog() introduces a race condition when __ioam6_fill_trace_data() runs in both softirq and process contexts, further increasing the chance of undefined behavior.

All Linux kernel installations that contain the IOAM6 networking code and have not applied the patch are affected. No specific kernel version or distribution is listed, so the impact applies to any kernel built before the changes were merged.

No publicly known exploit exists and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by specially crafted network traffic, the attack vector is likely remote over a network interface that uses IOAM6. The CVSS score is not provided but the nature of the out‑of‑bounds memory corruption suggests a high severity level. The EPSS score is unavailable, so the current exploitation probability cannot be quantified. Nonetheless, the potential for kernel crashes and the absence of a mitigation in older kernels warrant prompt attention.