The vulnerability occurs in the xfrm6 module of the Linux kernel where the function xfrm6_get_saddr() fails to check the return value of ipv6_dev_get_saddr(). When that helper reports no available source address, the address structure remains uninitialized, yet xfrm6_get_saddr() still signals success. Subsequent code that uses this address, such as xfrm_state_find(), may work with garbage data, leading to kernel memory corruption, KMSAN warnings, and potentially a kernel panic, resulting in a denial of service.

All Linux kernel installations that contain the xfrm6 module before the patch are affected. The vendor entries list Linux:Linux, indicating that any distribution using the standard Linux kernel is potentially impacted. No specific version list is supplied, so any kernel older than the commit that fixes the error is vulnerable.

Risk is uncertain because no CVSS or EPSS score is provided and the vulnerability is not listed in CISA KEV. The likely attack vector is local; an attacker would need the ability to invoke xfrm_tmpl_resolve_one(), for example by sending particular UDP packets that trigger address resolution. No public exploits have been documented, and the kernel does not expose an obvious remote trigger. However, local privilege escalation could allow a user to exercise the flaw, potentially causing a system crash or other disruption.