The Linux kernel contains a heap buffer overflow in the __ioam6_fill_trace_data() routine. The function blindly trusts the nodelen field supplied in an incoming IPv6 packet’s IOAM extension header, without validating it against the type field that declares which data items are present. An attacker can craft a packet with a zero nodelen while setting type bits corresponding to data items, causing the function to write roughly 100 bytes past the allocated buffer and corrupt heap memory. This corruption can trigger a kernel panic, effectively causing a denial of service.

All Linux kernel builds that have not yet incorporated the patch committing ioam6_trace_compute_nodelen() and the accompanying validation logic. The patch was applied to the mainline kernel; therefore, any system running an older kernel version before the change is affected.

The vulnerability can be exploited remotely by sending a malicious IPv6 packet that includes an IOAM trace header with an inconsistent nodelen/value. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but because the flaw results in a critical kernel crash and requires minimal specialized knowledge, the risk is considered high. An attacker who can reach the target system over the network can trigger the flaw without authentication.