An improper cleanup routine for fragment queues in the Linux kernel causes a use‑after‑free during network namespace teardown. When a fragment resumes after the queue has been flushed, the code dereferences a freed fragments_tail pointer, potentially crashing the kernel or allowing an attacker who controls the freed socket buffer data to execute arbitrary code. The flaw is present in IPv6, nf_conntrack_reasm6, and 6lowpan reassembly code paths.

All versions of the Linux kernel that have not yet incorporated the described patch are vulnerable. The issue impacts the standard Linux kernel used by all distributions and is specifically relevant to the IPv6, nf_conntrack_reasm6, and 6lowpan reassembly modules.

No public CVSS or EPSS score has been released, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation evidence. However, the use‑after‑free can render the kernel unstable or grant control to privileged attackers. Because the flaw is triggered during routine network namespace teardown, a threat actor would need the ability to create and destroy network namespaces on the affected system. Until a patch is applied, the risk is considered high for systems where network namespaces are in use.