The Linux kernel creates a Function‑Specific Next‑Hop Exception only when an ICMP Fragmentation Needed or Redirect message references a UDP packet that matches an existing socket. This conditional logic allows an off‑path attacker to probe the FNHE cache: by sending such ICMP errors and observing whether an FNHE entry is created or updated, the attacker can infer the source port of a connected UDP socket through a side‑channel, exposing confidential port information without requiring elevated privileges or direct connectivity to the target.

All Linux kernel installations prior to the inclusion of the commit that unconditionally creates FNHE entries before socket matching are affected. This includes every kernel derived from the mainline source that has not incorporated the diagnostic changes identified by commit 6457378f and 67d6d681e15b, and remains vulnerable until the new mitigation is applied. The issue is in core kernel code and is vendor‑agnostic.

Based on the description, the likely attack vector is an off‑path attacker sending crafted ICMP Fragmentation Needed or Redirect messages that quote a UDP packet and then observing whether a new or updated FNHE entry is created. The CVSS score of 7.4 places the flaw in the high‑severity range, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild at this moment. Because the exploit requires only the ability to send ICMP errors and observe kernel state via side‑channel techniques, an off‑path adversary can perform the attack from any remote network location that can reach the target. The lack of a listing in the CISA KEV catalog means the vulnerability is not currently known to be actively exploited, but the high impact of revealing UDP port numbers makes it a priority for remediation.