The Linux kernel’s IPv6 XFRM code contains a flaw where, on an error path, the device reference is released once with netdev_put but the destination device pointer remains set in the data structure. When dst_destroy later attempts to release the same reference again, the reference counter underflows, producing a ref_tracker warning and potentially destabilizing the network stack.

All builds of the Linux kernel that include the IPv6 XFRM implementation are affected. The vulnerability is listed for the generic Linux kernel product without version constraints, implying that any kernel using the xfrm6_fill_dst path in net/ipv6/xfrm6_policy.c is susceptible.

The CVSS score of 7.8 reflects a high severity for causing kernel instability. The EPSS score of < 1% suggests that exploitation is currently unlikely, and the vulnerability is not catalogued in CISA KEV. An attacker would need to trigger the specific error path—likely by sending crafted IPv6 traffic that causes in6_dev_get to return NULL—leading to a double net_device release and a possible kernel crash or denial of service. No privileged escalation or data exfiltration is implied; the impact is confined to kernel reliability.