An overflow of the 16‑bit UDP length field occurs when a UDP socket with IPv6 Path MTU Discovery enabled sends a packet larger than the IP6_MAX_MTU value allowed by the kernel. The kernel bounds the fragment size for such sockets, but if a device advertises an MTU larger than IP6_MAX_MTU and the socket option IPV6_MTU_DISCOVER is set to PROBE or DO, the length can be set to the device MTU. Sending a packet of 65528 data bytes plus headers results in a UDP length of 65536, which overflows the length field and triggers a kernel warning in udp_set_len_short. The description does not state that this causes a crash; it only notes the warning. The vulnerability is not exploitable through ordinary IPv6 traffic. An attacker must craft packets that satisfy the described conditions, i.e., set the device MTU beyond IP6_MAX_MTU and create a UDP socket with PMTU discovery in PROBE or DO mode. The effect is limited to the packet construction path; it could potentially destabilize packet handling by producing malformed packets. The potential impact is a denial of service in the network stack, inferred from the requirement to send crafted large packets that cause a kernel warning. The description does not provide direct evidence of a crash, so the severity is based on the overflow and the warning it produces.

The flaw exists in the Linux kernel networking code for IPv6. Any system running a Linux kernel version that does not include the fix that bounds cork->base.fragsize to IP6_MAX_MTU is affected. This includes all distributions whose kernels predate the relevant commit, regardless of version number. The vulnerability originates from the kernel’s networking layer, not from user‑space utilities.

The CVSS score of 5.5 indicates a moderate impact. The EPSS score of <1 % denotes a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, implying no known widespread exploitation. Exploitation requires deliberate packet crafting and control over the sending socket’s PMTU discovery option, and the attack vector is network-based. While the description does not confirm a crash, an overflow that triggers a warning could lead to a denial of service if the kernel mishandles the packet. Consequently, the risk is moderate but warrants mitigation.