The Linux kernel bug occurs when ipv6_hop_ioam() processes an IOAM Hop‑by‑Hop option while an interface is being torn down. Because it calls __in6_dev_get(skb->dev) without validating the returned idev pointer, a concurrent interface teardown can cause __in6_dev_get() to return NULL. The subsequent dereference of a NULL idev results in a kernel crash, which is a classic null‑pointer dereference (CWE‑476) and leads to denial of service. An attacker who can inject malformed IPv6 packets containing an IOAM Hop‑by‑Hop option directed at the vulnerable interface could trigger this crash.

The vulnerability affects the Linux kernel. All kernel releases prior to the patch that contain the ipv6_hop_ioam() function without a NULL check are potentially impacted. The CPE string indicates every Linux kernel platform. No specific version numbers are provided, so any unpatched kernel must be considered at risk.

The CVSS score of 7.5 reflects the denial‑of‑service nature of the flaw. The EPSS score of less than 1% indicates that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via crafted IPv6 traffic containing an IOAM Hop‑by‑Hop option; an attacker would need network access to the target to trigger the crash. The risk is moderate to high for systems requiring high availability, but the low EPSS suggests the threat is currently modest.