The vulnerability resides in the Linux kernel's IPv6 Segment Routing (seg6) handling. When a user sends a Generic Netlink command with a SEG6_ATTR_DST attribute that is too short, the kernel allows a 16‑byte read beyond the valid buffer. This out‑of‑bounds read copies uninitialized kernel heap data into the tunsrc field and returns it to userspace, leaking sensitive memory. The primary consequence is the disclosure of kernel information that can assist further attacks. The weakness stems from insufficient policy validation that permits shorter payloads for a NLA_BINARY attribute.

All Linux kernels that implement the IPv6 Segment Routing Netlink interface before the patch that changes SEG6_ATTR_DST from NLA_BINARY to NLA_POLICY_EXACT_LEN. The fix was validated on kernel 7.3.0‑rc3, so any pre‑patch kernel is vulnerable.

The issue is local; an attacker must be able to send Generic Netlink messages on the host. No network exposure is required, so the exploit is limited to a local user or process. The EPSS score is unavailable and the vulnerability is not in the CISA KEV catalog, indicating that current exploitation rates are unknown. Nonetheless, a local attacker can leverage the leak to aid other attacks, but the impact is confined to information disclosure rather than immediate privilege escalation.