The vulnerability stems from the function ip6erspan_changelink() using dev_net(dev) instead of the cached target network namespace, which causes a stale tunnel entry to be inserted into the wrong per‑namespace hash table. When the original network namespace is later destroyed, the stale entry is encountered and the kernel triggers a slab‑use‑after‑free detected by KASAN, followed by a BUG during device unregistration. The result is a kernel crash, which manifests as a denial‑of‑service condition.

Any Linux kernel versions that include the ip6gre module before the integration of commit 5e72ce3e3980 are affected. This includes all distributions running such kernels with the ip6gre and ip6erspan features enabled, regardless of the distribution name or specific kernel release, until a kernel that incorporates the fix is deployed.

The EPSS data for this CVE is not available and the vulnerability is not listed in the CISA KEV catalogue. The logical attack path is reachable from an unprivileged user namespace created via tools such as unshare with the --user and --net options (inferred from the description). An attacker would need to create such a namespace, manipulate an ip6gre tunnel with ip6erspan_changelink(), then delete the original namespace to trigger the stale entry. This path leads to a kernel crash, providing an application‑level denial‑of‑service; there is no documented possibility of privilege escalation or remote code execution according to the current description. The severity appears high due to the kernel crash, but exploitation likelihood cannot be quantified due to missing EPSS metrics.