A flaw in the Linux kernel IPv6 routing path selection code, a vulnerability classified as CWE‑835 (Infinite Loop), can cause a softirq‑side walker to enter an infinite loop while traversing the fib6_siblings linked list. The loop arises when the list is removed via list_del_rcu without synchronizing RCU readers, leaving a stale pointer that never reaches the terminator. The result is sustained CPU usage that can crash the system or drop network traffic, representing a classic denial of service scenario.

The vulnerable component is the Linux kernel IPv6 networking stack. All kernel releases prior to the commit that fixed fib6_select_path() (f8d8ce1b515a) are affected; only kernels containing that patch are considered safe.

The CVSS score of 7.5 classifies this defect as high severity. The EPSS value of less than 1% indicates that exploitation attempts are very rare at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves manipulation of routing table entries or transmission of packets that trigger route changes, a scenario that could be achieved by local users or by remote actors with sufficient network access. Because the trigger requires an active route modification during a softirq traversal, the probability of successful exploitation remains low but is not negligible in targeted environments.