In Linux kernels that implement the IP Virtual Server (IPVS) subsystem, a race condition exists between the network device notifier ip_vs_dst_event() and the code that caches destination routes when a network device is shut down. The race can allow a valid route to be returned from the routing stack after the notifier has released its reference to the now‑down device. The kernel may then keep a stale reference to the device in the IPVS destination structure, which could lead to instability or a crash if the reference is accessed later. This vulnerability is a classic resource‑leak race condition (CWE‑362).

All Linux kernel builds that include the IPVS facility are affected. No specific kernel version boundaries were enumerated in the CNA data; the patch that introduces a netif_running() check appears in the mainline after the referenced commits.

The CVE does not provide an EPSS score and is not listed in CISA's KEV catalog, suggesting no known public exploitation. The vulnerability requires control over network device shutdown timing and IPVS route updates, which generally needs elevated privileges. While the likelihood of successful exploitation is uncertain, the potential impact on system stability warrants prompt remediation.