The CVE involves the ipv6_rpl_srh_rcv function when decompressing a Source Routing Header (SRH). When the recompressed SRH is larger than the original, the code uses skb_push to consume unchecked headroom, resulting in a negative mac_header offset. This causes a 64 KiB out‑of‑bounds write to the packet buffer, as detected by KASAN. An attacker who can send a specially crafted IPv6 packet that forces the recompression to grow can leverage this flaw to corrupt memory, potentially gaining code execution on the affected system.

This flaw exists in the Linux kernel; no specific kernel versions are identified in the data. All distributions that ship the unpatched kernel should be considered affected until a build incorporating the fix is released.

The CVE is not listed in KEV, and no EPSS score is available, so the likelihood of exploitation is currently unknown. However, the vulnerability requires local ability to inject an IPv6 packet with a SRH into the system, which is typically an attacker with privileged network access or a local compromised process. The OOB write could lead to a kernel panic or more serious exploitation if the attacker can execute code in kernel mode. The impact is high because kernel corruption can lead to full system compromise. The attack vector is inferred to be local or via a compromised user capable of sending raw IPv6 packets.