The issue is a race condition in the Linux kernel’s IPv6 multicast implementation that can lead to a use‑after‑free when a network device is torn down while an MLD query is still being processed. During the race, the reference count of the inet6_dev structure may reach zero, the structure is freed, and delayed work later dereferences this freed memory, causing a kernel panic. The primary impact is a denial‑of‑service through a critical system crash.

The vulnerability exists in any Linux kernel build that does not contain the commit implementing the safe refcount helper. Because no specific release line is mentioned, all versions lacking that commit are potentially affected, including the latest stable releases until they incorporate the patch. The flaw applies to all IPv6‑enabled kernels that use the standard multicast code path.

The CVSS score of 9.8 classifies the flaw as critical, while the EPSS score of less than 1% indicates a very low probability of active exploitation at present. Based on the description, it is inferred that the likely attack vector is at the network layer, where an adversary can send malicious or high‑volume MLD query traffic to a host with active IPv6 interfaces during device teardown. Exploitation would trigger a kernel panic, resulting in a system crash. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet; however, the high severity warrants immediate remediation.