The Linux kernel's IPv6 implementation had a flaw in rt6_route_rcv() where the Route Information option length validation did not correctly enforce RFC 4191 constraints. Specifically, the option length field includes the 8-byte header, but the code accepted lengths that were too small for the given prefix length, leading to out-of-bounds reads when copying the prefix. This could cause the kernel to read and expose up to 8 bytes beyond the option boundary, potentially leaking adjacent packet data or uninitialized memory into the installed IPv6 route prefix. The vulnerability was fixed by enforcing stricter validation of the option length according to RFC 4191.

The vulnerability allows out-of-bounds reads in the kernel when processing IPv6 Router Advertisement packets with malformed Route Information options. This can lead to leakage of kernel memory contents into the IPv6 routing table entries visible to userspace. There is no information about code execution or denial of service. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description states it has been resolved, implying a fix is available. Users should apply the official Linux kernel updates that address this issue once released. Until patched, filtering or dropping suspicious IPv6 Router Advertisement packets with malformed Route Information options may reduce exposure.