The vulnerability resides in the IPv6 XFRM error handling code of the Linux kernel. The functions that process local PMTU and error packets incorrectly assume that the socket attached to the incoming packet’s skbuf is a full IPv6 socket. In reality, TCP SYN‑ACK packets may be handled with a request_sock, leading the code to miscast a small socket structure as a full inet/IPv6 socket and read memory beyond the request_sock allocation when they access inet_sock or ipv6_pinfo state. Based on the description, it is inferred that this out‑of‑bounds read can leak sensitive kernel data or corrupt memory, potentially enabling a local or remote attacker to crash the system or compromise data integrity.

Linux kernel. All builds of the Linux kernel that include the IPv6 XFRM stack are potentially impacted. No specific version numbers are provided in the CVE entry, so all current kernel releases should be treated as affected until the patch is applied or the distribution explicitly documents the fix.

The CVSS score of 7.8 indicates high severity, and the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploitation incidents to date. Based on the description, it is inferred that the flaw is triggered by receiving specific network traffic, which an attacker could send from a remote host. Based on the description, it is inferred that a successful exploit could result in a denial of service or local privilege escalation on the affected system.