The vulnerability in the Linux kernel’s IOAM6 networking code allows a possible out-of-bounds array access when trace->type.bit6 is set. The code retrieves the transmit queue for a packet without clamping the index, so if the packet is on the device’s receive path and the ingress device has more receive queues than the egress device has transmit queues, the index can exceed dev->num_tx_queues and dereference dev->_tx[] out of bounds. This flaw is confined to internal kernel structures and would manifest as memory corruption or instability, though no exploit or crash behavior is explicitly documented.

This issue applies to Linux kernel builds that include the IOAM6 subsystem and have not incorporated the change. No specific kernel version numbers are provided, so any kernel containing the affected code before the fix may be vulnerable. The CNA vendor list indicates Linux as the vendor.

The CVSS score of 9.1 reflects high severity for a kernel-level out-of-bounds access. The EPSS score is less than 1 percent, suggesting a low likelihood of exploitation at present. The vulnerability can be triggered by specially crafted network traffic that exercises the IOAM6 code path, implying a remote network attack vector. The vulnerability is not present in the CISA KEV catalog, and no public exploits have been reported as of the data provided.