A flaw in the Linux kernel’s handling of IPv6 UDP exception caching allows an attacker to probe the kernel by sending ICMPv6 Packet Too Big or Redirect Message packets that quote a UDP packet. These crafted messages cause the kernel to create or update an entry in the IPv6 exception cache even before it attempts to match the quoted UDP packet to an existing socket. By observing changes to the exception cache, an attacker can infer which local UDP port is being used by a connected socket, effectively leaking transport port information without executing code or escalating privileges.

The issue exists in the Linux kernel across all vendors identified as Linux. No specific kernel versions are listed; it affects any build preceding the commits that enforce creation of exception cache entries before socket lookup.

The vulnerability is a side‑channel information disclosure. The CVSS score of 3.7 indicates low severity. The EPSS score of <1% indicates a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog, so widespread exploitation is currently unknown. The likely attack vector is off‑path delivery of crafted ICMPv6 error messages; this is inferred from the description because the exploit requires sending such packets. The attack requires no privileged kernel interaction, but the attacker must be able to observe the kernel’s exception cache state, which typically implies a degree of proximity to the target machine. Given the lack of an immediate exploitation path for privilege escalation, the risk is considered moderate to high for exposed systems that receive unsolicited IPv6 error messages.