The Linux kernel stores a pointer to the network header while walking IPv6 extension headers. When the Host Address Discovery option is processed, a helper may expand the packet buffer and move the packet head, leaving the cached pointer stale. A subsequent read uses this invalid pointer, which can cause a kernel crash. This flaw is a form of memory corruption and is classified as CWE‑825.

Any Linux kernel version that has not yet incorporated the recent Git commits that correct the handling of the HAO option is affected. No specific version information is provided in the CVE record, so any distribution running an unpatched kernel is at risk.

The CVSS score is 9.8, indicating a critical severity. The EPSS score is less than 1%, showing a very low yet non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is a remote attacker sending a crafted IPv6 packet containing the HAO option or other malformed extension headers, which triggers the stale pointer usage and results in a kernel crash, effectively causing a denial‑of‑service condition.