In Linux kernels, the icmp_route_lookup() function performs multiple route lookups to determine how to send ICMP error messages while respecting IPsec policies. A race condition in the reverse‑path lookup path can allow an attacker to add a new local IP address between a locality check and a subsequent input route lookup. If that address becomes local during the race, the lookup may return a route of type RTN_LOCAL that is later used as an output route, triggering the internal ip_rt_bug path and emitting a kernel warning. The bug does not crash the kernel or expose sensitive data, but the warning indicates incorrect routing behavior and could lead to misrouted ICMP replies or repeated warnings that affect system logs.

All Linux kernel builds that contain the vulnerable icmp_route_lookup() implementation before the race‑condition fix was merged. No specific major or minor version range is listed in the advisory; the fix appears in later kernel releases following the commit that added the rt_type check after ip_route_input().

An exploit would require local or privileged access to trigger the race condition; the flaw does not result in immediate denial of service or data exposure. EPSS is not available and the vulnerability is not listed in CISA KEV, indicating a low likelihood of widespread exploitation. Nevertheless, the presence of a race condition and its impact on kernel logs warrants applying the patch as soon as it becomes available.