A bug in the Linux kernel’s IPv6 hop‑by‑hop header path causes the ipv6_hop_jumbo() function to trim the socket buffer with pskb_trim_rcsum(). Without recomputing the next‑header pointer afterward, the kernel can keep a stale pointer that references invalid memory. This flaw, classified as CWE‑825, can lead to memory corruption and a kernel crash when an attacker processes a crafted IPv6 packet.

All installations of the Linux kernel that have not incorporated the patch recomputing the next‑header pointer after a hop‑jumbo trim are potentially vulnerable. The CNA lists only Linux as the affected vendor, and no distribution or kernel version is specified, so any default kernel prior to the fix may be susceptible.

The CVSS score of 9.8 indicates a very high potential severity. The EPSS score of less than 1 % suggests that large‑scale exploitation is currently uncommon, and the vulnerability is not yet catalogued in CISA’s KEV list. An attacker who can deliver crafted IPv6 packets to the target can trigger the flaw, potentially causing memory corruption, a kernel crash, or other instability. The attack vector is inferred to be remote, relying on the victim’s network stack.