The vulnerability in the Linux kernel's IPv6 RPL implementation arises from improper handling of the recompressed Source Routing Header (SRH). Specifically, ipv6_rpl_srh_rcv() decompresses the SRH, swaps the next segment into the IPv6 destination address, then recompresses the header. The recompressed header can be larger than the original when the compression prefix length decreases. The kernel function pskb_expand_head() was only called when segments_left was zero, so earlier segments could consume unchecked headroom. When skb_push() reduces the available headroom below skb->mac_len, skb_mac_header_rebuild() sets the mac_header offset incorrectly, causing a wraparound and a subsequent memmove() to write approximately 64 KiB past the skb->head buffer, leading to an out-of-bounds write. This memory corruption can compromise system stability and security. The fix involves expanding the headroom whenever the remaining space is insufficient for the push plus mac_len, preventing the overflow.

This vulnerability allows an attacker to cause an out-of-bounds memory write in the Linux kernel's IPv6 packet processing path. The CVSS vector indicates network attack vector with no privileges or user interaction required, and impacts confidentiality, integrity, and availability at a high level. Exploitation could lead to kernel memory corruption, potentially causing system crashes, denial of service, or privilege escalation. No known exploits in the wild have been reported yet. The issue affects the core Linux kernel networking stack, making it critical for systems that process IPv6 packets with RPL SRH.

A security update fixing this vulnerability is available from Red Hat as part of their kernel security update advisory RHSA-2026:34095. The update expands the headroom in skb buffers to prevent out-of-bounds writes during SRH recompression. Users of affected Red Hat Enterprise Linux 9.2 versions should apply the kernel update and reboot their systems to ensure the fix takes effect. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated; applying the official fix is required.