The vulnerability arises from ip4ip6_err() calling icmp_send() on a cloned skb whose cb[] was populated by the IPv6 receive path as struct inet6_skb_parm. icmp_send() then passes this skb to __ip_options_echo(), which interprets the cb[] as struct inet_skb_parm (IPv4). Due to differing layouts, a field overlap causes a non-zero rr value, leading __ip_options_echo() to read an attacker-controlled optlen and copy that many bytes into a fixed 40-byte stack buffer, resulting in a stack buffer overflow. The fix clears skb2->cb[] before use and adds minimal IPv4 header validation. Red Hat issued kernel live patch modules for affected kernel versions in RHEL 9 and 10 to address this critical issue.

Successful exploitation could allow an attacker to trigger a stack buffer overflow in the kernel, potentially leading to arbitrary code execution, system compromise, or denial of service. The vulnerability is rated critical with a CVSS 3.1 base score indicating network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Red Hat has released official kernel live patch modules (kpatch-patch-5_14_0-687_10_1 for RHEL 9 and kpatch-patch-6_12_0-211_16_1 for RHEL 10) that address this vulnerability. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. These patches clear the vulnerable skb2->cb[] buffer and add IPv4 header validation. No additional mitigation is indicated by the vendor advisory.