The vulnerability arises from a race condition in the Linux kernel's IPv6 router discovery function, which reads and writes the in6_dev->ra_mtu field without proper synchronization. The race can result in inconsistent or corrupted values for the router advertisement MTU, leading to unpredictable kernel behavior and potential memory corruption. According to the KCSAN diagnostic output, concurrent read and write operations on this field were observed, indicating that an attacker could trigger the race by sending crafted IPv6 router advertisement packets.

The affected code exists in the Linux kernel, specifically documented in version 6.19 release candidates (rc1 through rc6). The CPE entries also list the generic "linux_kernel" product, implying that any kernel build containing this code path is potentially affected until the patch is applied. Users running Linux kernel 6.19 or earlier, or any derivative that has not yet incorporated the fix, should consider their systems vulnerable.

The CVSS score of 5.5 indicates a moderate severity. The EPSS probability is below 1 %, reflecting a low but non-zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been exploited at large scale. The attack vector appears to be local or network-based: an adversary can craft IPv6 router advertisement packets that manipulate the MTU value, potentially triggering the race. Because the fix currently only annotates the race without addressing the underlying synchronization error, the risk remains until an official kernel update is released.