The Linux kernel’s nf_conntrack reassembly code improperly increments the skb->mac_header offset after removing an IPv6 fragment header. This causes the helper that checks for a MAC header to misclassify a packet’s headroom as a valid header location. Subsequent accesses through the erroneous pointer can read or write outside the packet’s bounds, leading to kernel memory corruption and a system crash. This out‑of‑bounds memory access allows a malicious actor to potentially exploit the vulnerability.

All Linux kernel builds that include the nf_conntrack reassembly component are affected, encompassing the standard kernel in major distributions and custom kernels. No version range is specified, so any kernel containing this code path is potentially vulnerable.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation data at present. Nonetheless, the flaw can be triggered by an attacker who can send or manipulate IPv6 packets that include a fragment header and are processed through the NF_INET_LOCAL_OUT defrag path. A crash results in denial of service and, in certain circumstances, could lead to broader kernel memory corruption. The risk is moderate to high for network‑connected hosts capable of sending such fragments, while hosts that disable IPv6 or block fragment headers mitigate the attack surface. The CVSS score of 7.8 reflects a high severity with potential for kernel memory corruption and denial of service.