The vulnerability arises from the IPv6 encapsulation handler in the Linux kernel failing to release a referenced destination entry when a route lookup error occurs. Each packet processed along this code path that encounters an error will leak a reference to the destination table, gradually consuming kernel memory and potentially degrading system performance or leading to eventual service disruption.

All Linux kernel versions before the applied patch are affected. The problem manifests in the generic Linux kernel code base; no specific vendor or minor release is singled out in the advisory.

The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is either local or remote delivery of specially crafted IPv6 encapsulated packets that trigger the lookup failure. Although the description does not mention direct code execution capabilities, repeated exploitation could lead to raw resource exhaustion, effectively denying legitimate use of networking services. Manipulating network traffic to reach the vulnerable code path would be the prerequisite for the leak to occur.