A NULL pointer dereference in the Linux kernel’s IPv6 forwarding information base (FIB) walk routine can cause a kernel panic when a multi‑batch dump operation resumes on a stale table pointer. The stack trace shows a crash triggered by an unexpected NULL parent pointer during a fib6_walk_continue call. The effect is an abrupt system shutdown or reboot, exposing the affected system to downtime or a continued attack if an attacker can force the crash.

All Linux kernel versions that contain the ipv6 fib6 implementation before the commit that stores tb->tb6_id in the callback arguments are vulnerable. The vulnerability applies to every distribution that ships a kernel built from the Linux source tree without incorporating this patch, regardless of specific distribution or patch level.

The vulnerability requires triggering a fib6 dump operation while a concurrent table modification occurs. Based on the description, the likely attack vector is a network‑initiated netlink dump or a local user executing the dump. Attackers with sufficient network privileges to provoke a netlink dump or a local user capable of initiating such an operation could cause a kernel panic. The exploit is a local or network‑initiated denial of service with no remote code execution. The EPSS score is low (<1%) and the issue is not listed in CISA KEV, suggesting limited public exploitation but the consequence of a kernel crash is high. The fix prevents the exception by anchoring the walk to the table ID instead of a positional index, ensuring that a table rescan always resumes on the correct structure.