The vulnerability resides in the Linux kernel’s IPv6 routing code and triggers a panic when an IPv4 route references a loopback‑only IPv6 nexthop object. The panic occurs because the kernel misclassifies the standalone IPv6 nexthop as a reject route, skipping essential initialization and later dereferencing a NULL pointer. In practice, this leads to a full system crash, causing a loss of availability for affected hosts. The weakness is categorized as CWE‑909, an improper handling of an array index or pointer manipulation leading to a crash.

This issue affects all Linux kernel builds that include the routing code, as indicated by the vendor entry for Linux:Linux and the generic CPE string for Linux kernels. No specific version range is listed in the CNA data, so any kernel version before the fix in commit 21ec9277 shall be considered vulnerable. The affected devices are those running a Linux kernel that has not been updated to incorporate the patch. The problem occurs only when a loopback device is used as a next‑hop for an IPv4 route via a standalone IPv6 nexthop object.

The CVSS score of 5.5 classifies the vulnerability as moderate, but the EPSS score indicates a very low probability of exploitation (<1%). The kernel crash is a denial‑of‑service attack, generally requiring the ability to create or modify routing entries. This capability is usually restricted to privileged users; remote exploitation is unlikely. The risk is therefore limited to insiders or attackers who have gained local or network‑configuration privileges. The absence of the vulnerability from the CISA KEV catalog further suggests that it has not been widely exploited in the wild.