The vulnerability in the Linux kernel's ip6_tunnel subsystem arises because ip6ip6_err() clones an outer IPv6 ICMP error skb and passes it to icmpv6_send() without clearing the skb2->cb[] metadata. If the outer packet contained a Home Address Option (HAO), the stale metadata (dsthao offset) remains after skb_pull(), causing mip6_addr_swap() to use an invalid offset on the inner packet. This can result in out-of-bounds memory access and corruption of skb_shared_info. The fix clears skb2->cb[] before pulling the inner IPv6 packet to prevent reuse of stale metadata.

This vulnerability can cause memory corruption in the kernel's networking stack when processing specific malformed IPv6 tunneled packets with Home Address Options. Such corruption could potentially lead to system instability or crashes. No information about exploitation in the wild or privilege escalation is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Linux kernel security announcements for updates addressing this issue.