The Linux kernel’s nft_inner_parse_l2l3() function incorrectly overwrites the transport‑header offset when parsing inner IPv6 packets. Although ipv6_find_hdr() computes the correct offset through all extension headers, the result is immediately replaced with the fixed value for an IPv6 base header (40 bytes). This desynchronizes inner_thoff, which points to the start of the first extension header, from l4proto, which correctly identifies the transport protocol. An attacker can exploit this mismatch to forge transport‑layer headers, causing netfilter to misinterpret the packet protocol and potentially allow traffic to evade firewall rules. The flaw does not disclose data but subverts packet filtering logic, enabling malicious traffic perceived as legitimate.

All stable releases of the Linux kernel from version 6.2 onward are affected, as the vulnerability resides in the core netfilter nft_inner module. Red Hat errata and other distribution advisories cover patched kernel releases (e.g., 6.2.1 and newer). The issue applies to generic Linux kernel builds and therefore impacts a broad range of vendor distributions that ship embedded or host kernels.

The CVSS score of 9.1 indicates high severity, describing a critical impact on availability and integrity of network filtering. The EPSS score is below 1%, suggesting that, at present, the probability of exploitation is very low, and it is not listed in the CISA KEV catalog. The exact attack vector is not detailed in the source data; however, based on the nature of the flaw, the likely vector involves the attacker being able to inject or modify inner IPv6 packets that traverse the host’s netfilter stack—meaning close network proximity or compromised network devices may be required. The risk remains significant because the vulnerability permits bypass of firewall policies that rely on correct protocol labeling.