In the Linux kernel, the addrs_lock used by IPvlan was global to the device instead of per port. Because IPv6 address changes can occur without holding the RTNL lock, concurrent address operations could interleave, producing a race that manifests as false‑negative detection of busy addresses and possible state corruption when ipvlan_ht_addr_add is called under different locks. While these races are unlikely to happen concurrently on multiple CPUs, they can still corrupt the internal address tables, potentially causing service disruptions when IPv6 addresses are added or removed.

The vulnerability affects the Linux kernel. The affected code paths are present in kernels before the patch that moved the addrs_lock to a per‑port basis. Versions listed in the CVE’s CPEs, such as 6.19 release candidates 1 through 6 and all Linux kernel releases built before the fix, are impacted. Any environment that employs ipvlan networking under those kernel versions is at risk.

The CVSS score of 7.8 indicates high severity, while the EPSS score is less than 1 %, reflecting a very low exploitation probability. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation would require concurrent manipulation of IPv6 addresses on an ipvlan interface, which typically demands local or privileged access. This could lead to inconsistent IP assignments and potential service disruption, but there is no evidence that it provides an elevation of privileges beyond that level.