A use‑after‑free occurs when the Linux kernel’s inet6_addr_del() function calls ipv6_del_addr() before confirming that the address is temporary, allowing a freed memory reference to be accessed. This results in a slab use‑after‑free error that corrupts kernel memory. The vulnerability is documented through a KASAN stack trace demonstrating an illegal read after the object has been freed.

The issue affects the Linux kernel itself. From the CPE data, affected releases include the generic Linux kernel as well as specific revisions 6.13 and all 6.19 release candidates from rc1 through rc8. Any system running one of those kernel versions is potentially susceptible until the distinguishing code is removed or replaced.

The CVSS base score of 7.8 signifies high severity, but the EPSS score of less than 1 % indicates a low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, an attacker could trigger the flaw by causing IPv6 address deletion via the appropriate ioctl interface, which typically requires elevated privileges. The memory corruption could be leveraged by a privileged attacker to compromise kernel execution integrity, though active exploitation has not been reported. The overall risk is therefore high for privileged users but low for general unprivileged users.