The flaw occurs in the IPv6 IOAM handling path where the hdr pointer is not refreshed after skb_ensure_writable may reallocate the socket buffer, resulting in a use‑after‑free condition (CWE‑825). The stale hdr pointer leads to a use‑after‑free when calling ioam6_event, which can corrupt kernel memory and trigger a kernel crash or provide a foothold at kernel level.

All Linux systems running a kernel version that does not yet incorporate the patch shown in the provided kernel commits. The vulnerability is present in the generic Linux kernel source and thus affects installations across the entire spectrum of mainstream distributions until the fix is applied.

The CVSS score of 9.8 indicates critical severity. The EPSS score is below 1 %, suggesting the probability of exploitation is very low, though many systems remain vulnerable. The vulnerability is not listed in CISA KEV. Because the trigger is a crafted IPv6 IOAM packet, the likely attack vector is a remote network‑based attack, requiring the attacker to send malformed packet data to a vulnerable host. If exploitation succeeds, the resulting use‑after‑free could transition from a denial‑of‑service to privilege escalation or remote‑code‑execution.