The Linux kernel’s IPv6 stack builds control messages for extension headers using a header‑length byte received on the wire. A nftables payload‑write expression can overwrite that byte after the packet has been parsed but before the control message copy occurs. The copy routine then reads up to ((hdrlen+1) << 3) bytes, potentially exceeding the bounds of the sk_buff linear area. This triggers a slab‑out‑of‑bounds read that can expose kernel memory contents. The CVE description does not mention denial of service or code execution; the flaw primarily allows information disclosure through the read vulnerability.

All Linux kernel releases prior to the commit that added ipv6_get_exthdr_len are affected. Any kernel that has the general Linux kernel entry without the new validation logic is at risk.

The CVSS score of 7.1 indicates high severity, while an EPSS score of less than 1% suggests a low current exploitation likelihood. The flaw is exploitable from an unprivileged process within a user namespace that can manipulate nftables rules; the attack vector is local. No evidence in the description indicates denial of service or code execution. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation yet.