Detection and KASAN logs reveal that the Linux kernel's IPv6 fragment reassembly subsystem can perform an out‑of‑bounds write when a fragmented packet reaches a queue that has previously been cleared and whose reassembly metadata has not been properly invalidated. The condition can corrupt heap objects, leading to arbitrary kernel memory corruption. An attacker that can direct crafted fragmented packets to a target system—typically from an unprivileged network namespace—can exploit this flaw to gain root privileges on that host. The flaw does not allow direct data exfiltration but can lead to a full kernel compromise.

All Linux kernel binaries are potentially affected; the vulnerability was addressed in a patch that flushes incomplete IPv6 fragmentation queues before they are destroyed. The relevant kernel sources are tracked by the commit set linked in the advisories, and any deployment of a kernel built from a revision older than that commit is susceptible.

Because the exploit depends on delivering malformed IPv6 fragments, it is an attacker‑controlled network‑traffic vector typically restricted to the host's network namespaces. The CVSS score of 7.8 indicates moderate severity, and the EPSS score is less than 1%, indicating a very low probability of exploitation. The lack of a KEV listing suggests that widespread exploitation has not yet been observed. Nevertheless, given the clear path to local privilege escalation, the risk is high enough that any system exposing IPv6 fragmentation should be promptly patched. If an immediate upgrade is not possible, administrators can mitigate by disabling IPv6 fragmentation processing or limiting ingress traffic to trusted namespaces.