The flaw resides in the Linux kernel’s IPv6 extension header parsing when handling tunneled traffic. The kernel incorrectly treats certain outer extension headers as malformed and drops the packet, or mistakenly spans headers across the outer tunnel boundary, leading to false positives. Because the kernel dereferences pointers without verifying the presence of inner headers, malformed or crafted packets cause the kernel to drop them. The outcome is a loss of connectivity for applications that rely on IPv6 tunnels such as GRE, ip6_tunnel, or SCTP-in-UDP, and the functionality of the host may be reduced or halted for sustained traffic.

All Linux kernel releases that have not yet incorporated commit c4336a07eb6b, which corrects the IPv6 extension header detection logic, are affected. This includes every distribution’s kernel version at the time of the CVE, as the vulnerability is present across the entire IPv6 networking stack of the Linux kernel.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score is listed as less than 1%, implying a low current probability of exploitation. The vulnerability is not currently in the CISA KEV catalog. Based on the description, it is inferred that an attacker may craft tunneled IPv6 traffic that triggers the kernel’s mis‑parsing, causing it to drop packets. By sending such traffic from a remote network site, an attacker could degrade or deny services that depend on tunneled IPv6 connections.