Linux Kernel EUVD-2026-27612

IPv6 IOAM (In-situ OAM) functionality must be explicitly enabled in the kernel configuration (CONFIG_IPV6_IOAM6_LWTUNNEL=y) and actively processing IOAM extension headers on network interfaces. IOAM is NOT enabled by default in standard Linux distributions-it requires explicit configuration for telemetry collection in network monitoring scenarios. Attack requires the target system to accept and process IPv6 packets with IOAM headers, meaning network path must not filter IPv6 extension headers and system must be configured as an IOAM-capable node. If IOAM is disabled or not compiled into the kernel, the vulnerable code path is never reached. Standard Linux servers and desktops without specialized network monitoring configurations are not exploitable. Exploitation is limited to network service providers, data centers, or research networks that deployed IPv6 IOAM for operational telemetry.

Real-world risk is LOW despite High CVSS severity. CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated network exploitation, but this assumes IOAM is configured and processing IPv6 packets with IOAM headers-a non-default configuration in most deployments. EPSS score of 0.02% (4th percentile) reflects security community assessment that exploitation is unlikely, corroborated by absence from CISA KEV and no identified public POC. The impact is limited to denial of service (C:N/I:N/A:H) via kernel panic/crash, not code execution. SSVC factors: exploitation status is none, automatable is yes (if IOAM enabled), technical impact is partial (DoS only). Priority should be MEDIUM for systems with IPv6 IOAM explicitly enabled, LOW for default configurations. The tag 'Information Disclosure' in metadata appears inconsistent with CVSS confidentiality:none-likely mislabeling, as the CVE description and impact indicate pure availability issue.

An attacker crafts IPv6 packets with IOAM extension headers containing specific trace data options and sends them to a target Linux system with IOAM processing enabled. When the kernel's __ioam6_fill_trace_data() function processes the malicious packet, it calls __in6_dev_get() which returns NULL under certain network interface states. The function dereferences this NULL pointer without validation, triggering a kernel panic and causing immediate denial of service. No authentication or user interaction required if the target accepts IPv6 IOAM packets.