Within the Linux kernel, the CIPSO (Confidentiality IP Security Option) handler omitted adjustment of cached option offsets after removing a CIPSO attribute. When a CIPSO byte sequence is stripped from a packet, following IP options such as the Redirect Route (RR) carry stale cached offsets. Functions that consume these offsets, like packet forwarding or echo logic, may read or copy bytes from incorrect positions. This misinterpretation can overwrite kernel memory or corrupt packet processing logic, potentially leading to a denial of service or system instability.

The vulnerability affects all Linux kernels that lack the commit correcting the offset calculation. Systems running older kernel releases—prior to the patch inserted around commit 2200fe1d6148b78e1b8f00f4b2bd47760015077f—are potentially impacted. Distribution packages still shipping such kernels are at risk, so checking the local kernel version against the referenced commit dates is necessary to confirm exposure.

The CVSS score of 8.1 classifies the flaw as high severity, but the EPSS score of less than 1% indicates a low current exploitation probability. The issue is not indexed in CISA’s KEV catalog. An attacker could trigger the flaw by sending crafted IP packets that include a valid CIPSO option followed by other options. Because the trigger originates from network traffic, remote exploitation is possible, though no public exploit has been released.