In the Linux kernel’s IPsec AH6 handling, the routine ipv6_rearrange_rthdr() assumes that the segments_left value of a routing header never exceeds the number of addresses indicated by the hdrlen field. When a raw IPv6 packet with the HDRINCL extension is processed and carries a large segments_left (e.g., 255) while hdrlen refers to only one address, the routine calculates and moves the address pointer 4,064 bytes backwards and passes that length to memmove(). This produces an out‑of‑bounds memory write that corrupts kernel memory. As the code runs with full kernel privileges, a successful exploitation can allow an attacker to execute arbitrary code or crash the system, compromising integrity and availability.

All Linux systems that ship an unpatched kernel containing the faulty AH6 logic are affected. The vulnerability resides in the core xfrm subsystem; any distribution that includes AH6 support—either compiled into the kernel or built as a module—can be compromised. Administrators should consider any kernel version that has not incorporated the commit that adds the segments_left invariant check as vulnerable.

While no CVSS or EPSS score is supplied, the nature of the bug suggests a severe impact. Based on the description the likely attack vector is remote network traffic: an attacker who can inject a specially crafted raw IPv6 packet with a mismatched segments_left value could trigger the out‑of‑bounds write. The kernel’s privileged context means that successful exploitation could result in arbitrary code execution at ring‑0. The absence of a KEV listing does not reduce the threat, as the issue remains exploitable whenever the vulnerable node can receive such packets.