The 6LoWPAN transmit path accepts packets that are not IPv6. When such a packet is queued, the header creation routine exits early, leaving the address information in the packet headroom uninitialized. Subsequent calls to reconstruct the header blindly copy and use this uninitialized data, creating a use‑of‑uninitialized‑memory situation that can lead to unpredictable behavior, memory corruption, or accidental information disclosure. The same flaw also manifests in the Bluetooth 6LoWPAN implementation in net/bluetooth/6lowpan.c bt_xmit(), where non‑IPv6 packets are processed without proper initialization. The condition is a classic uninitialized variable misuse and is therefore a SECURITY BOUNDARIEFFECT.

Any Linux kernel that implements the 6LoWPAN subsystem and hosts a 6LoWPAN interface is affected. The vulnerability exists in all kernel releases that contain the legacy 6LoWPAN driver before the fix is applied; no specific version list is provided, but the affected code is part of the core 6LoWPAN implementation for all current kernels.

The CVSS score of 7.8 indicates a moderate‑to‑high impact. The EPSS score of less than 1% shows that exploitation attempts are currently very rare. The issue is not listed in the CISA KEV catalog, suggesting no widely known active exploits. An attacker could potentially send a crafted non‑IPv6 packet to a 6LoWPAN interface from the local network or via a compromised device, leveraging the uninitialized data to corrupt memory or leak restricted information. The likely attack vector is network‑based through the device’s 6LoWPAN interface, with local or remote execution conditions depending on network configuration.