The Linux kernel’s ip6t_hbh module, which processes IPv6 hop‑by‑hop options, does not validate the length of user‑supplied option lists during rule setup. This allows a crafted packet containing more than the 16 allowed option descriptors to trigger an array‑index‑out‑of‑bounds access on the fixed `opts` array. The resulting kernel panic causes a system crash and disrupts availability. No code execution or data exfiltration is possible, but the crash can be triggered remotely by sending a malformed packet to any host with the module loaded.

All Linux kernel installations that include the vulnerable ip6t_hbh code path prior to the commit that added the bounds check are affected. The detailed version information is not provided, so any kernel lacking the patch for this issue is potentially vulnerable.

The exploit requires the ability to send specially crafted IPv6 packets that reach the kernel’s packet‑matching logic. The attack can be launched from any network with reachability to the target. While the EPSS score is unavailable and the vulnerability is not in CISA’s KEV catalog, the potential for a kernel crash represents a significant operational risk, especially for systems exposed to untrusted traffic.