This flaw originates from a race condition in the Linux kernel’s IPv6 routing stack. When a node that holds the tb6_lock performs a list_del_rcu on the fib6_siblings list without permitting RCU readers to finish, the next pointer remains dangling into the old list. A softirq‑side walker traversing this list never reaches the sentinel node, causing it to loop indefinitely and stall the CPU. The weakness is a concurrency flaw involving improper synchronization and race conditions, reflecting CWE‑835.

All Linux kernel implementations that include the vulnerable rt6_fill_node routine and run IPv6 routing are affected. Because the fix is applied to the core kernel code, any distribution shipping a kernel version prior to the commit f8d8ce1b515a that introduced the safeguard could be impacted.

The reported CVSS score of 5.5 indicates moderate severity. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. While a local or privileged attacker could trigger the loop by manipulating route entries (inferred), the lack of a publicly documented exploit and the low EPSS suggest that the overall risk remains modest but non-zero. The impact is confined to CPUs running the vulnerable kernel; remote attackers would need to influence routing under a trusted execution boundary to activate the denial of service (inferred).