A use‑after‑free flaw exists in the Linux kernel’s ILA transport checksum adjustment routine. The code caches a pointer to the IPv6 header before calling pskb_may_pull; if the packet is non‑linear and the skb is reallocated during that call, the cached pointer becomes dangling. Subsequent reads and writes on the freed memory in ila_update_ipv6_locator result in a slab‑use‑after‑free that can corrupt kernel memory, potentially affecting system stability or security. The description does not confirm that this corruption leads to privilege escalation or execution, but kernel memory corruption poses a serious risk.

The vulnerability affects any Linux kernel that includes the ILA module in its networking stack. No specific kernel versions are enumerated, so all current and supported releases that contain the referenced code paths are considered potentially impacted until a vendor releases a patch.

The CVSS score of 9.8 indicates a high severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. Triggering the flaw requires CAP_NET_ADMIN rights to configure an ILA csum‑adjust‑transport route or mapping; once configured, an unauthenticated attacker can send IPv6 packets that exercise the use‑after‑free. No evidence is provided that the vulnerability is being actively exploited or that it leads to remote code execution, but the low exploitation likelihood and the possibility of kernel memory corruption suggest a modest risk.