A flaw in the Linux kernel’s CIPSO option handling leads to the offset for subsequent IP options remaining stale after the CIPSO attribute is removed. Consumers such as packet forwarding and option echoing calculations then reference invalid memory locations, potentially causing untrusted packet data to be interpreted as option lengths and copied into fixed‑size buffers. This misuse of packet contents can corrupt kernel memory or cause anomalous behavior when processing network traffic.

The vulnerability is present in Linux kernel implementations that do not include the recent commit correcting the cached offset logic; specific affected releases are not listed in the advisory, implying that any kernel version prior to the patch may be susceptible. All distributions using the default Linux kernel should verify whether their kernel contains the fix introduced in the linked commits.

No EPSS score or KEV designation is available, and a CVSS score is not provided, so the overall severity cannot be precisely quantified. However, the flaw can be triggered by a network attacker sending crafted IP packets containing CIPSO options, which would lead to a local kernel memory corruption if the victim processes the packet. Given the lack of publicly available exploitation examples, the risk is moderate but not negligible, and operators should treat it as a potential avenue for local privilege escalation or denial of service.