A slab-out-of-bounds read vulnerability in the Linux kernel IPv6 implementation affects multiple stable kernel branches and allows local users to cause memory disclosure or denial of service.

This is an out-of-bounds read vulnerability within the ip6_datagram_recv_specific_ctl() function, triggered by manipulated IPv6 extension header lengths via nftables, requiring low local privileges.

A successful exploit allows local attackers to read sensitive kernel memory or cause kernel crashes leading to denial of service, impacting system availability and confidentiality. The CVSS score of 7.1 reflects the high severity of potential local system compromise, though exploitation requires local access.

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or later depending on the active release branch.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unexpected KASAN bug reports related to put_cmsg.

Compensating Controls: Restrict local user namespace creation and limit access to nftables configuration capabilities where feasible.

Public Exploit Available: false

Administrators must prioritize updating vulnerable Linux kernel installations to the patched versions across all maintained branches. Applying these kernel updates immediately removes the risk of slab-out-of-bounds memory exposure and potential denial of service attacks by local users.