A race condition exists in the Linux kernel’s IPv6 routing logic for seg6 and rpl lightweight tunnels. The flaw occurs when a NOREF destination cache entry is created during ip6_route_input and it is later released by a concurrent higher‑priority task, leading to a dst_hold() on a freed object. This use‑after‑free is identified as CWE‑911 and could cause kernel instability or a crash if the freed object is accessed. The documented race sequence shows that the vulnerability is exposed during recv-side processing of IPv6 packets that trigger seg6_input_core or rpl_input, and relies on the kernel’s per‑CPU routing structures.

All Linux kernel builds that enable IPv6 and the seg6 or rpl lightweight tunnel features are potentially vulnerable under PREEMPT_RT configurations that do not enforce PREEMPT_RT_NEEDS_BH_LOCK. It is inferred that systems running a standard non‑PREEMPT_RT kernel or lacking shared nexthop objects may not experience the race path, but this is not explicitly confirmed in the advisory.

The CVSS score of 8.1 indicates high severity. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires concurrent traffic that traverses seg6/rpl tunnels and a preemptible ksoftirqd on the same CPU, conditions that are highly specific. It is inferred that, while possible, practical exploitation may be limited without specialized triggering traffic and kernel configuration.