The vulnerability arises in the IPv4 Forwarding Information Base (FIB) implementation of the Linux kernel. During a route insertion, a newly allocated alias is registered and then, if a notifier fails, it is removed and freed immediately. A concurrent lookup can still access the freed alias, causing a read of freed memory. The result is a Use‑After‑Free that could allow an attacker to corrupt kernel memory, potentially leading to privilege escalation or a crash. The weakness aligns with CWE‑416.

All Linux kernels that include the affected FIB code before the commit that introduces the fix. No explicit version range is listed, so any system running a pre‑fixed kernel is susceptible.

The exploit requires the CAP_NET_ADMIN capability and a fib notifier that rejects a route. A local attacker with such privileges can trigger the path, making the risk local but with high impact. The EPSS score is not available and the vulnerability has not been listed in CISA’s KEV catalog, indicating no known public exploitation at the time of reporting. The CVSS score is not provided. Given the severity of a use‑after‑free and the privilege requirements, the overall risk is considered significant for affected systems.