The vulnerability stems from the netfilter ip6t_rt module in the Linux kernel. When a rule is configured with rtinfo->addrnr equal to zero while the IP6T_RT_FST_MASK option is enabled, the packet processing loop incorrectly advances the index past the number of routing addresses. This causes the code to read memory beyond the ip6t_rt structure, triggering UBSAN/KASAN out‑of‑bounds warnings or fatal kernel panics. The primary impact is a denial of service or kernel instability; the flaw does not provide direct remote code execution but can disrupt services and potentially enable further exploitation if attacker privilege escalates.

All Linux kernels that include the netfilter ip6t_rt functionality before the patch are affected, regardless of distribution or specific version. The issue is present in any kernel that implements the ip6t_rt module without the fix present in the referenced commits. Systems that use ip6tables rules requiring IP6T_RT_FST_MASK with a zero address count are particularly vulnerable.

The bug can be triggered by any entity capable of crafting IPv6 packets that match a misconfigured netfilter rule, allowing a single packet to cause a kernel panic and thus denial of service on the target machine. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating limited widespread exploitation to date. The CVSS score of 7.1 denotes high severity; nevertheless, because the flaw leads to an out‑of‑bounds read that can bring down the kernel, the risk remains moderate for affected systems. No confirmed remote code execution path exists, but the impact on availability is significant.