The Linux kernel contains a type‑confusion flaw in the IPv6 IOAM (Internet‑Based Address‑Marking) module. An IOAM lightweight‑tunnel state may store a dummy routing entry as a plain dst_entry structure, but the IPv6 routing cache treats it as a full rt6_info structure. The resulting invalid cast allows the kernel to read fields from the wrong object, producing an incorrect routing cookie and potentially an invalid pointer dereference. If the wrong cookie is used while the dst->obsolete flag is zero, or when rt->sernum is zero, the kernel may read a per‑CPU field that can alias a zeroed value, leading to memory corruption or an OOPS. The weakness is a type‑confusion bug that can corrupt kernel memory.

This defect affects the generic Linux kernel when the IOAM IPv6 lightweight‑tunnel feature is enabled. All distributions that compile the upstream kernel with the lwt_ioam option turned on are vulnerable until the upstream commits that embed a full rt6_info struct are applied. No vendor‑specific product or version information is listed beyond the generic linux_kernel identifier, so any kernel build containing lwt_ioam remains exposed.

The CVSS score of 9.8 indicates extremely high severity, but the EPSS score is below 1 %, meaning community data shows a very low probability of exploitation at the time of this analysis. The vulnerability is not included in CISA’s KEV catalog. Based on the description, the most plausible attack vector is a local or privileged process that can alter IOAM configuration or state, as the flaw occurs inside kernel routing logic. Because it can corrupt kernel memory, the impact is severe, although the likelihood of active exploitation remains low according to the EPSS metric.