In the Linux kernel's ipv6_find_hdr() function, each IPv6 extension header's declared length is used to move through the packet without verifying that the cumulative offset remains inside the packet's actual size, allowing the function to return an offset past the end of the packet; this offset is then consumed by Open vSwitch, which sets the transport header and later calls update_ipv6_checksum(), causing out‑of‑bounds reads and writes that lead to a slab‑use‑after‑free and other memory‑corruption errors. Based on the description, the likely attack vector is the network transmission of crafted IPv6 packets containing malformed or oversized extension headers, which can trigger the vulnerability and potentially cause a kernel panic or privilege escalation. This flaw is a classic example of a CWE‑787 out‑of‑bounds write.

Affected systems include any Linux kernel build that contains the unpatched ipv6_find_hdr() function. The CVE entry does not provide explicit affected version numbers; users should refer to vendor advisories for their precise kernel release. All kernels compiled before the official patch are potentially vulnerable, and every installation of Open vSwitch that relies on that kernel routine is also affected, since the bug is exercised when it processes IPv6 packets.

The vulnerability can be triggered by sending crafted IPv6 packets with malformed or oversized extension headers to a host or device running Open vSwitch. The exploit requires network access to the target; it does not depend on local user privileges. While no public exploit is documented, the EPSS score is less than 1 %, and the CVSS score is 8.1, indicating high severity. The vulnerability is not listed in the CISA KEV catalog, but its exploitation could lead to denial of service or privilege escalation if an attacker can repeatedly trigger the faulty code path.