The vulnerability in the Linux kernel IPv6 code occurs in the __ip6_append_data() function when handling paged allocation with MSG_MORE and MSG_SPLICE_PAGES flags on UDPv6 sockets. Incorrect calculation of allocation length and paged length due to unaccounted fragment gap (fraggap) bytes leads to an undersized linear buffer and an overstated paged length, causing a buffer overflow that writes beyond the skb linear area into skb_shared_info. This flaw allows an unprivileged user to trigger memory corruption. The issue was introduced by a commit that allowed MSG_SPLICE_PAGES to proceed despite negative copy values, which previously returned an error. The fix involves adjusting alloclen and pagedlen calculations to include fraggap correctly and removing obsolete negative copy checks.

The vulnerability allows an unprivileged user to cause a buffer overflow in kernel memory by sending specially crafted UDPv6 packets with MSG_MORE and MSG_SPLICE_PAGES flags. This can lead to memory corruption with potential consequences including denial of service, privilege escalation, or arbitrary code execution in the kernel context. The CVSS vector indicates low attack complexity and privileges required, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch links are provided in the input data. Until a patch is available, avoid using UDPv6 sockets with MSG_MORE and MSG_SPLICE_PAGES flags in untrusted environments to reduce risk.