The flaw resides in the Linux kernel’s netfilter ip6tables subsystem, where the validation of advertised length fields in the AH, HBH, and RT IPv6 extension headers is incomplete. Because the kernel fails to verify the advertised length before using it, a packet containing a malformed extension header can be incorrectly treated as a rule mismatch. The result is that packets with these headers are dropped if the kernel is misconfigured but are otherwise allowed, because the hotdrop flag is never set for the malformed packet. This vulnerability is an instance of improper input validation (CWE-130) that can lead to malformed data being processed, resulting in a firewall bypass.

All Linux kernel builds that do not contain the netfilter hotdrop patch for ip6tables are at risk. Every system running a kernel version released prior to the patch, regardless of distribution or frozen release, remains vulnerable until the fix is applied. Recent stable kernel releases that include the code change are considered safe.

With a CVSS score of 9.1 the flaw is classified as critical. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not included in the CISA KEV catalog. From the description it is inferred that an attacker would need to inject a crafted IPv6 packet over the network to the target system; such a packet could be crafted by an adversary with network‑level access and would bypass firewall rules designed to reject packets with these IPv6 extension headers, potentially allowing malicious traffic to reach internal hosts.