The Linux kernel’s netfilter flowtable module contains a flaw in the handling of IPv6-over-IPv6 tunnels (IP6IP6). The patched implementation replaces skb_header_pointer with pskb_may_pull to ensure the outer IPv6 header is in the skb headroom. This indicates the earlier code could have performed an out-of-bounds memory read, potentially leading to a kernel crash. The vulnerability could be exploited by an attacker who sends malformed IP6IP6 packets, which would trigger the vulnerable code path and result in loss of availability.

The change applies to all Linux kernel versions that compile the netfilter flowtable module with IP6IP6 tunnel support. No specific kernel release range is given in the advisory, so any kernel built with the affected flowtable component is potentially impacted.

The EPSS score of less than 1% indicates a very low probability of exploitation. The description focuses on correcting a potential out-of-bounds read; the exploitability would likely require an attacker to craft IP6IP6 packets that are processed by the affected kernel, which is feasible from an open network. This suggests a remote denial of service risk, but the likelihood remains low. The vulnerability is not listed in CISA KEV, implying no confirmed exploitation in the wild as of this analysis.