In the Linux kernel, when ICMP fragmentation‑needed or redirect messages quote a UDP packet, the kernel creates a Function‑Specific Next‑Hop Exception (FNHE) only if it can match the quoted UDP packet to an existing socket. This behaviour allows an off‑path attacker to probe the FNHE cache and discover the source port of an associated UDP socket via a side‑channel. The vulnerability exploits the caching mechanism used for short‑lived UDP connections; by sending crafted ICMP errors the attacker can cause the kernel to create or update entries in the FNHE cache. Observing whether a cache entry appears or how long it persists reveals the UDP port, enabling further UDP‑based attacks or session hijacking. The weakness aligns with information disclosure and side‑channel attack patterns, as it leaks internal kernel state to a remote, unauthenticated adversary.

Affected systems are all Linux kernel deployments that have not incorporated the mitigation commits (6457378f and 67d6d681e15b). The kernel versions prior to these commits, which can be found across many Linux distributions, will process ICMP errors by creating FNHE entries only when a matching UDP socket exists. The vulnerability is not limited to a specific vendor or product name beyond the generic Linux kernel; no particular CPE version list is provided, so all kernels lacking the patch remain vulnerable.

The CVSS score is not provided, EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack can be performed by an off‑path network adversary who can send ICMP error messages that quote UDP packets. No local privilege escalation is required, but the attacker needs the ability to observe the FNHE cache, which could be achieved through timing or side‑channel analysis of kernel response patterns. Because the exploit does not rely on a privileged context and can be triggered remotely, the risk remains moderate to high; however, the lack of an official patch means that any affected system is currently at risk until mitigation steps are applied.