The Linux kernel’s IPv6 SRv6 packet handling code contained a null‑pointer dereference vulnerability. When __in6_dev_get() returns NULL—such as on a device without IPv6 configuration—the callers seg6_hmac_validate_skb() and ipv6_srh_rcv() failed to check the pointer. An attacker could send a malicious SRv6 packet or otherwise trigger this logic on a vulnerable interface, causing the kernel to crash and the host to reboot, which results in a denial‑of‑service for all services on the machine.

The flaw applies to any Linux kernel build that predates the commit adding the NULL‑check, including older 4.10 releases and all 7.0 release candidate kernels listed in the CPE data. All popular Linux distributions that ship those kernel versions are affected, regardless of vendor, because the patch is part of the upstream Linux kernel source.

The CVSS base score of 5.5 marks the vulnerability as moderate, while the EPSS score of <1% indicates a low probability of real‑world exploitation. The vulnerability is not flagged in the CISA KEV catalog. The likely attack vector is the delivery of a crafted SRv6 packet over the network; since the bug originates in packet handling logic, an attacker does not need local privileges. Successful exploitation would stop the node from servicing any traffic, but the impact is limited to a service interruption for the compromised machine.