A race condition in the Linux kernel's handling of IPv6 route lists can lead to a use‑after‑free when freeing a list element during flush operations. The bug causes writes to a freed memory block, triggering KASAN detections and often resulting in a kernel panic. The vulnerability does not disclose remote code execution by itself, but the crash can be leveraged by an attacker to disrupt system availability, especially in environments where the network stack is frequently reconfigured.

All Linux kernel versions from 3.6 onward, including the 6.19 release candidates up to rc8, are affected. The race flaw resides in the generic kernel code that manages both IPv6 and, eventually, IPv4 routing lists, so any distribution shipping one of these kernel versions could be impacted until the bug is fixed.

The CVSS score of 4.7 denotes moderate severity, and the EPSS score of less than 1% indicates a very low probability of widespread exploitation. The vulnerability was demonstrated by syzbot during fuzzing, suggesting that a knowledgeable attacker could reliably trigger it by crafting specific network traffic or by manipulating interface states. However, the lack of a known public exploit and the relatively low exploitation probability mean that the risk is moderate, but not negligible for systems exposed to untrusted network traffic.