The Linux kernel sit (IPv6 over IPv4) tunnel code caches a pointer to the inner IPv6 header when ipip6_tunnel_xmit() starts. Later, after Generic Segmentation Offload processing, the code assumes the cached pointer remains valid. However, iptunnel_handle_offloads() may clone or reallocate the socket buffer header, which can move the skb head and invalidate the cached pointer. If the pointer is used afterwards, the code reads the hop limit and DS field from memory that may have been freed, leading to an out‑of‑bounds read or kernel memory corruption (CWE‑825).

All Linux kernel releases that have not yet incorporated the upstream fix for this problem are vulnerable. CPE data shows that kernel versions 7.1 rc1 through rc7, as well as any earlier releases containing the unpatched sit tunnel implementation, are affected. Systems running those kernels, whether stock or custom builds, will be at risk if SIT tunnels are enabled.

The CVSS score of 9.8 signals a critical impact, while the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to deliver a specially crafted SIT packet to a host that has SIT tunnelling active and GSO enabled. The attack could be carried out from an external or local source depending on network exposure, and could result in kernel memory corruption or information disclosure. No publicly known exploits exist at this time.