The Linux kernel’s IPv6 routing code rt6_route_rcv() incorrectly validates the length of the Route Information option in a Router Advertisement. The validation accepts lengths that are one unit longer than RFC 4191 allows, so when a sender advertises a 128‑bit prefix with a length field of 2 (or a 64‑bit prefix with length 1) the kernel copies eight bytes beyond the supplied data. These out‑of‑bounds bytes become part of the prefix in the route entry and are subsequently exposed to userspace tools such as ip‑6‑route. The flaw results in an out‑of‑bounds read that can lead to information disclosure.

All Linux kernels prior to the commit that fixes the length check are vulnerable. The advisory does not list specific release numbers; therefore any system running a kernel that does not yet contain this patch should be considered affected. The fix is referenced in the provided commit URLs, so upgrading to the latest stable kernel series that incorporates those changes removes the issue.

The vulnerability does not allow direct code execution; it only leaks kernel data. The CVSS score of 7.5 reflects a high severity. An attacker must be able to inject a spoofed Router Advertisement message on an interface that accepts RA traffic, which requires access to the same local network or control of routing infrastructure. The attack vector is therefore local‑network or controlled‑routing. No public exploits are known, the EPSS score is < 1%, and the issue is not listed in CISA’s KEV catalog. Despite the lower likelihood of exploitation, the potential impact on confidentiality is high because kernel memory can contain sensitive data. The flaw is an out‑of‑bounds read that can expose information.