The CVE involves the ipv6_rpl_srh_rcv function when decompressing a Source Routing Header (SRH). When the recompressed SRH is larger than the original, the code uses skb_push to consume unchecked headroom, which produces a negative mac_header offset. This results in a 64 KiB out‑of‑bounds write to the packet buffer, as detected by KASAN. The flaw is a classic buffer overrun and also allows integer underflow leading to miscalculated headroom (CWE-131). Based on the description, it is inferred that an attacker can send a specially crafted IPv6 packet that forces the recompression to grow, thereby leveraging this flaw to corrupt memory and potentially gain code execution on the affected system.

This flaw exists in the Linux kernel; all Linux distributions shipping an unpatched kernel version are potentially affected until a build incorporating the fix is released.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of < 1% suggests a very low probability of exploitation, and the CVE is not listed in KEV. The vulnerability requires local or privileged ability to inject a crafted IPv6 packet with a SRH, typically via raw IPv6 traffic on the loopback or a compromised process with network privileges. The out‑of‑bounds write could lead to a kernel panic or, if an attacker obtains kernel mode code execution, full system compromise. Based on the description, the likely attack vector is local or via a user capable of sending raw IPv6 packets.