The Linux kernel’s skb_maybe_pull_tail() routine subtracts skb_headlen(skb) from an unsigned maximum value and passes the result to __pskb_pull_tail() as a signed integer. When IPv6 extension headers cause the packet to have a linear area larger than MAX_IPV6_HDR_LEN, the subtraction can underflow, producing a negative delta that skb_copy_bits() interprets as a very large copy length. This unchecked copy can overwrite arbitrary kernel memory, which can crash the system. The vulnerability is exactly characterized by the CWE IDs for buffer overflows and underflows.

All Linux kernel releases that contain the unpatched skb_checksum_setup_ipv6 implementation are affected. Any installation using a kernel version prior to the fixes referenced in the advisory commit series is vulnerable; the affected product is the Linux operating system kernel.

The flaw can be triggered by sending specially crafted IPv6 packets that include overly large extension headers, making the vulnerability reachable from the network. The CVSS score of 7.5 denotes medium‑to‑high severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Although no public exploits exist yet, the combination of a kernel crash outcome and the possibility of remote packet delivery means that exposed systems serving untrusted IPv6 traffic are at non‑negligible risk until a patch is applied.