The Linux kernel's IPv6 code did not properly validate the length of extension headers when building control messages (cmsgs). Specifically, ip6_datagram_recv_specific_ctl() trusted the on-wire hdrlen byte without revalidation after parsing. An nftables payload-write expression could modify hdrlen after parsing but before the skb reached recvmsg, causing put_cmsg() to read beyond the actual header buffer, resulting in a slab-out-of-bounds read. The vulnerability is reachable from an unprivileged user namespace. The fix introduced a new function ipv6_get_exthdr_len() to validate header length against skb boundaries and applied this check consistently across all relevant code paths, preventing out-of-bounds reads.

This vulnerability allows an unprivileged user namespace to cause a slab-out-of-bounds read in kernel memory, which could lead to kernel crashes or potentially information disclosure. No known exploits in the wild have been reported. The impact is limited to local unprivileged users with access to nftables and IPv6 socket operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix has been implemented in the Linux kernel source code by adding proper validation functions and bounds checks. Users should monitor official Linux kernel advisories and update to a fixed kernel version once available. No alternative mitigations are described.