The Linux kernel’s IPv6 Segment Routing implementation allows an attacker to force an out‑of‑bounds read when a Generic Netlink message contains a SEG6_ATTR_DST attribute that is shorter than required. The attribute is defined as a binary payload with a maximum length, but the kernel incorrectly accepts shorter payloads and then copies 16 bytes from kernel memory that have not been initialized. When the tun_src field is later queried, these 16 bytes are sent back to the attacker, leaking kernel heap data. This vulnerability is an instance of CWE‑125 (Out‑of‑Bounds Read) and can disclose sensitive information that may aid further attacks.

The flaw exists in every Linux kernel version that does not incorporate the fix that changes SEG6_ATTR_DST validation to enforce an exact attribute length of 16 bytes. Kernel releases prior to the inclusion of the patch—identified in the commit history by the series of stable branch commits referenced in the advisory—are vulnerable. For example, the Linux 7.3.0‑rc3 kernel and older versions lack the protection and will leak data if the offending Netlink command is sent. Versions that have incorporated the fix, starting with the kernel release that applies the underlying commit, are not affected.

The CVSS score of 3.3 reflects a low overall severity, largely due to the fact that exploitation requires the capability to send privileged Generic Netlink commands. The requirement for CAP_NET_ADMIN is inferred from the need to send a SEG6_CMD_SET_TUNSRC command, as defined in the Linux kernel source, because the description does not explicitly state the privilege level. In practice, this limits the threat to local users with elevated rights or to hostile code that has already compromised the host. The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further suggesting that active attackers have not yet targeted it. Nevertheless, because the disclosed data could assist in privilege‑escalation or further compromise, patching remains the recommended priority.