A null‑pointer dereference bug exists in the Linux kernel’s IPv6 SRv6 packet handling code. The function __in6_dev_get() can return NULL when a network interface lacks IPv6 configuration, and the callers seg6_hmac_validate_skb() and ipv6_srh_rcv() did not verify the pointer. A malicious SRv6‑enabled packet targeting such an interface can cause the kernel to crash, resulting in a denial‑of‑service for the host.

All Linux kernel distributions built before the commit that added the NULL‑check are affected. The vulnerability applies universally across vendors, regardless of specific kernel release numbers, because the change is not tied to a particular version list.

The base CVSS score of 7.0 indicates high severity, but no EPSS score is available and the issue is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a crafted SRv6 packet over the network, a conclusion inferred from the packet‑processing nature of the bug. Successful exploitation would cause a kernel crash and loss of service, with no additional user‑level impact described in the report.