Technical impact
In the Linux kernel, the helper addrconf_permanent_addr contains logic that warns users of an exceptional condition after the IPv6 address structure may already have been freed. The message is delivered too late, so the code can access memory that has potentially been reclaimed, creating a classic use‑after‑free flaw.
Affected Systems
All Linux kernel implementations are affected; the vulnerability exists until the patch that reorders the warning and moves it outside the idev->lock guard is applied.
Risk and Exploitability
The use‑after‑free flaw exists in the kernel's IPv6 address configuration code. An attacker may trigger the vulnerable code path by allocating and deleting IPv6 addresses, which can happen during normal network operations. Because the flaw arises inside privileged kernel code, successful exploitation would likely require local privileged execution or remote network-based manipulation of IPv6 traffic. The CVSS score of 7.8 indicates high severity, though the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Depending on the attacker’s capabilities, exploitation could lead to kernel memory corruption, resulting in denial of service or privilege escalation, but the public description does not specify the exact outcome.
Debian DLA
Ubuntu USN