An IPv6 tunnel bug in the Linux kernel allows a malicious actor to craft a malformed inner packet that triggers an out‑of‑bounds write during the handling of a quoted ICMP error message. The cloned outer packet retains the Home Address Option offset in the skb's control buffer, which is then incorrectly applied to the quoted inner packet. This causes the address swap routine to read past the end of the inner packet, corrupting the skb_shared_info structure. The memory corruption can be abused for arbitrary code execution, as the kernel writes beyond the bounds of a heap object (CWE-787).

All Linux kernel implementations that include the ip6_tunnel module and do not apply the fix that resets skb->cb before pulling the quoted packet are affected. The advisory references several kernel commits containing the patch; users running older stable or custom kernels lacking these commits are vulnerable. No specific version numbers are listed, so kernel maintainers should consult the commit identifiers in the provided links.

Although no CVSS score or EPSS is available, the kernel‑level nature of the flaw and the ability to trigger it via crafted IPv6 ICMP error traffic indicate a high risk of remote exploitation. The bug can be triggered over a network interface without local privilege, making it a serious threat even though it is not yet listed in CISA KEV. Depending on network exposure, attackers could leverage the memory corruption to execute code with kernel privileges.