The vulnerability in the Linux kernel seg6 code arises because decap_and_validate() pulls outer SRv6 headers and sets the inner packet as the skb network header without properly resetting the IPv6 control block (IP6CB). The IP6CB retains values from the outer packet, including a large nhoff offset. When inner packets are processed by ip6_protocol_deliver_rcu(), this stale offset causes reads beyond the skb head, leading to a slab-out-of-bounds error reported by KASAN. The fix involves clearing IP6CB for the inner packet while preserving the incoming interface index and L3 slave state, and correctly setting nhoff to the inner IPv6 base-header nexthdr field.

An unprivileged user can exploit this vulnerability by installing a local Segment Identifier (SID) and injecting specially crafted packets with outer extension headers. This can cause the kernel to read out-of-bounds memory, potentially leading to kernel crashes or other undefined behavior. There is no indication of known exploits in the wild.

A fix has been implemented in the Linux kernel to properly reset the IPv6 control block after decapsulation. Users should apply the official kernel updates that include this patch. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the relevant patch and update accordingly.