The flaw occurs in the Linux kernel’s IPv6 XFRM layer where, on an error path, the device reference held in xdst->u.dst.dev is released twice. This double netdev_put underflows the reference counter, provoking a ref_tracker warning and potentially causing a kernel panic or crash. The weakness originates from improper resource cleanup, leading to an unsafe state in the networking stack.

All Linux kernel builds that contain the xfrm6 code described are potentially affected, as the CVE does not list a restricted version range. The issue resides in the xfrm6_fill_dst function within the kernel’s IPv6 XFRM implementation.

The explicit attack vector is not provided, but the bug can be triggered by manipulating IPv6 traffic that drives in6_dev_get to fail, implying a local or remote exploitation path via the IPv6 stack. The EPSS score is unavailable, so exploitation likelihood cannot be quantified, yet the possibility of a kernel crash elevates the risk. The vulnerability is not currently listed in the CISA KEV catalog.