The bug occurs in the Linux kernel's seg6_validate_srh function, which checks the Segment Routing Header (SRH) before any fields are read. No guard ensures the supplied length covers the fixed SRH fields, so a 2‑byte SEG6 header that a BPF program can supply causes the validator to read srh->type and srh->len from beyond the provided buffer. This buffer overread and boundary violation can expose unintended data or corrupt kernel memory, an out‑of‑bounds read (CWE-125), allowing an attacker to disclose sensitive information or crash the system.

Any Linux kernel that builds with the BPF Segment Routing infrastructure and has not incorporated the seg6_validate_srh patch is affected. This includes standard distributions and custom kernels that enable BPF SEG6 actions. No precise version range is listed, so all builds prior to the commit that introduced the patch are considered vulnerable.

The CVSS score of 7.8 classifies the flaw as high severity, indicating significant potential impact on kernel confidentiality, integrity, and availability. The EPSS score of <1% signals a low probability of active exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread attacks. Nevertheless, the flaw lies in a privileged kernel path and requires an adversary able to inject or load a BPF program that uses SEG6 actions to trigger the overread. If successful, the attacker could read beyond the provided buffer, potentially exposing kernel memory contents or corrupting kernel state.