A memory corruption vulnerability in the Linux kernel ip6_tunnel subsystem allows local authenticated users to trigger potential system crashes or privilege escalation.

The vulnerability exists in the ip6_tnl_xmit function, which incorrectly manages socket buffer (skb) ownership during headroom expansion. This flaw allows an authenticated local attacker to cause a use-after-free scenario because the kernel may free an skb that is still referenced by the caller after an error occurs.

Successful exploitation of this kernel-level vulnerability can lead to a complete system compromise, including privilege escalation and arbitrary code execution. Given the CVSS score of 7.8, this flaw represents a significant risk to the integrity and availability of affected systems, particularly in multi-tenant environments or systems providing shell access to untrusted users.

Immediate Action: Apply the latest kernel patches provided by your distribution vendor, ensuring the kernel is updated to at least version 5.10.270, 5.15.221, 6.1.188, 6.12.109, 6.18.50, or 7.2.4.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected segmentation faults that may indicate an exploitation attempt.

Compensating Controls: Restrict local access to the system to authorized users only, as the vulnerability requires local access to the kernel interface to trigger the flawed code path.

Public Exploit Available: No (exploit_available: false)

Organizations should prioritize patching this kernel vulnerability as part of their standard maintenance cycle. While exploitation is currently not observed in the wild, the potential for privilege escalation necessitates prompt remediation on all Linux-based systems.