The vulnerability arises in the IPv4 Forwarding Information Base (FIB) implementation of the Linux kernel. During a route insertion, a newly allocated alias is registered and then, if a notifier fails, it is removed and freed immediately. A concurrent lookup can still access the freed alias, causing a read of freed memory. The result is a Use‑After‑Free that could allow an attacker to corrupt kernel memory, potentially leading to privilege escalation or a crash.

All Linux kernels that include the affected FIB code before the commit that introduces the fix. No explicit version range is listed, so any system running a pre‑fixed kernel is susceptible.

The exploit requires the CAP_NET_ADMIN capability and a fib notifier that rejects a route. A local attacker with such privileges can trigger the path, making the risk local but with high impact. The EPSS score is < 1% and the vulnerability has not been listed in CISA’s KEV catalog, indicating no known public exploitation at the time of reporting. The CVSS score is 7.0. Given the severity of a use‑after‑free and the privilege requirements, the overall risk is considered significant for affected systems.