The vulnerability resides in the Linux kernel's IPv6 tunnel (sit) code where an inner IPv6 header pointer is cached at function entry and reused after generic segmentation offload (GSO) handling. During offload processing, the socket buffer header may be cloned or reallocated, invalidating the cached pointer. The stale pointer can then be used to read the hop limit and DS field from a freed memory area. This improper read could leak sensitive packet information or lead to memory corruption at the kernel level, jeopardizing system integrity.

All Linux kernel releases that include the sit tunnel code and have not incorporated the upstream fix are affected. The vulnerability applies broadly to Linux kernels running any version before the patch commit referenced in the provided kernel patches.

The EPSS score is unavailable not currently listed in CISA's KEV catalog, indicating no active exploitation reports. Nevertheless, the flaw could be exploitable by a privileged local attacker who can construct a tunnel packet that triggers GSO processing. The risk level is moderate: while the vulnerability may lead to data leakage or memory corruption, it requires specific conditions and is not immediately widely exploitable. No public exploits are known at this time.