The vulnerability occurs in the Linux kernel function ipv6_rpl_srh_rcv() which decompresses an RFC 6554 Source Routing Header (SRH). When recompressing the SRH after swapping the next segment into the IPv6 destination address, the recompressed header can grow larger than the original due to changes in prefix compression. The kernel function pskb_expand_head() only expands headroom when segments_left equals zero, allowing unchecked consumption of headroom on earlier segments. This leads to skb_mac_header_rebuild() setting a mac_header offset that wraps to a large value, causing a memmove() operation to write approximately 64 KiB past the skb->head buffer, resulting in an out-of-bounds write. This memory corruption can cause denial of service or arbitrary code execution by a local attacker. Red Hat has issued a patch for affected products and recommends disabling IPv6 Source Routing as a mitigation.

Successful exploitation of this vulnerability can cause memory corruption in the Linux kernel, leading to denial of service (kernel crash) or potentially arbitrary code execution with kernel privileges. The vulnerability affects the integrity, confidentiality, and availability of the system. It requires local attacker access and no user interaction. The CVSS v3.1 base score is 9.8 (critical), reflecting the high impact and ease of exploitation under the specified conditions.

A fix is available from Red Hat as a kernel update for Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2. Systems should apply the updated kernel packages and reboot to remediate the vulnerability. As a temporary mitigation, administrators can disable IPv6 Source Routing by setting the sysctl parameters net.ipv6.conf.all.accept_source_route=0 and net.ipv6.conf.default.accept_source_route=0. This prevents the kernel from processing IPv6 Source Routing Headers and avoids the vulnerable code path. Note that disabling IPv6 Source Routing may impact network configurations relying on this feature.