The Linux kernel's IPv6 routing code rt6_route_rcv() incorrectly validates the length of the Route Information option in a Router Advertisement. The validation accepts lengths that are one unit longer than the RFC allows, so when a sender advertises a 128‑bit prefix with a length field of 2 (or a 64‑bit prefix with length 1) the kernel copies eight bytes beyond the supplied data. Those out‑of‑bounds bytes become part of the prefix in the route entry and are subsequently exposed to userspace tools such as ip‑6‑route. This results in an information‑disclosure vulnerability that can leak arbitrary kernel memory to services that read the routing table.

All Linux kernels prior to the commit that fixes the length check are vulnerable. The advisory does not list specific release numbers; therefore any system running a kernel that does not yet contain this patch should be considered affected. The fix is referenced in the provided commit URLs, so upgrading to the latest stable kernel series that incorporates those changes removes the issue.

The vulnerability does not allow direct code execution; it only leaks kernel data. An attacker must be able to inject a spoofed Router Advertisement message on an interface that accepts RA traffic, which requires access to the same local network or control of routing infrastructure. The attack vector is therefore local‑network or controlled‑routing. No public exploits are known, the EPSS score is not available, and the issue is not listed in CISA's KEV catalog. Despite the lower likelihood of exploitation, the potential impact on confidentiality is high because kernel memory can contain sensitive data.