The Linux kernel incorrectly modifies the Segment Routing Header and destination address of IPv6 packets without first ensuring that the packet data can be safely written. This can cause the kernel to write into packet data that may be shared with a clone, such as one created for an AF_PACKET socket. An attacker can craft a packet that triggers this behavior, resulting in the cloned socket receiving a modified packet instead of the original. The flaw does not directly allow arbitrary code execution but does allow an attacker to tamper with packet contents and potentially to leak or alter data seen by local applications.

Any Linux kernel that has not yet applied the fix for the seg6 packet handling bug is vulnerable. The issue is present in the core kernel network stack and therefore affects all distributions that ship a kernel built with the default IPv6 implementation. No specific distribution version is listed, so the vulnerability applies broadly to all currently running kernels until the patch is deployed.

The CVSS score is 3.7 and the EPSS score is less than 1%, indicating a low to moderate severity and very low exploitation probability; it is not listed in the CISA KEV catalog. When a packet is received, advance_nextseg may write into data that is shared with a clone, allowing a crafted packet to modify what a local AF_PACKET socket sees. Based on the description, the likely attack vector is a local user able to send packets to an AF_PACKET interface or a network actor able to inject IPv6 traffic into a local network. No publicly available exploit is known, so exploitation would probably require precision packet crafting, which raises the difficulty level. Nonetheless, the kernel's ability to modify packet content means that any attacker who can trigger the flaw could manipulate information delivered to local processes. The absence of a published exploit suggests that while the risk is real, the likelihood of immediate exploitation is moderate.