Severity by source
Network-delivered IPv6 packet requires no auth or interaction; OOB read yields kernel memory leak (C:L) and potential crash (A:H); no integrity impact.
Lifecycle Timeline
2DescriptionCVE.org
[rx_ip6 IPv6 extension header OOB read; 16-bit len wrap]
AnalysisAI
Out-of-bounds read in the IPv6 extension header receive path (rx_ip6) allows a remote unauthenticated attacker to trigger kernel memory disclosure or a denial-of-service condition via a crafted IPv6 packet with a malicious 16-bit extension header length field that wraps around during bounds calculation. Reported by Ubuntu vendor channels, this is inferred to affect the Linux kernel's IPv6 network stack, though the exact upstream component is not confirmed from available data. No public exploit code has been identified at time of analysis, and KEV status is not confirmed.
Technical ContextAI
IPv6 extension headers carry a Length field encoded as an 8-bit value (units of 8 octets), but intermediate processing code may accumulate or cast lengths into 16-bit integers. A 16-bit wrap (integer overflow or underflow) in the rx_ip6 receive path can cause the computed buffer boundary to fall below the actual data pointer, resulting in an out-of-bounds read - CWE-125, likely triggered by CWE-190 (Integer Overflow) or CWE-191 (Integer Underflow/Wrap). No CWE is formally assigned in the input data; the classification above is inferred from the vulnerability description. No CPE strings were provided, so exact affected kernel versions cannot be confirmed from this dataset alone.
Affected ProductsAI
The affected product is inferred to be the Linux kernel, specifically within the IPv6 extension header receive path (rx_ip6 function), based on Ubuntu vendor reporting and the function naming convention consistent with Linux kernel networking code. No specific kernel version range, CPE string, or Ubuntu package version is provided in the available data. Defenders should monitor Ubuntu Security Notices (USN) and the upstream Linux kernel stable mailing list for version-specific advisories. No vendor advisory URL was included in the input data.
RemediationAI
No exact patched version or vendor advisory URL was supplied in the available data, so a precise upgrade target cannot be stated. Monitor Ubuntu Security Notices at ubuntu.com/security/notices and the upstream kernel stable releases at kernel.org for a fix targeting the rx_ip6 IPv6 extension header length handling. As a compensating control, consider disabling IPv6 on interfaces where it is not operationally required (sysctl -w net.ipv6.conf.all.disable_ipv6=1) - note this may disrupt IPv6-dependent services. Alternatively, network-layer ACLs dropping IPv6 packets with extension headers from untrusted sources can reduce exposure without fully disabling IPv6. Restrict external IPv6 routing at perimeter firewalls where feasible. These are mitigations with operational trade-offs; patching remains the only definitive fix.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today