An issue in the Linux kernel’s networking subsystem allows the reference count of a fib_rule object to be increased while the object is in the process of being freed. The race between the RCU dump path (fib_rules_dump) and the deletion of the rule leads to a refcount assertion failure, causing the kernel to panic. The weakness is a misuse of reference counting that can be classified as CWE-416 (Use After Free), CWE-754 (Race condition between acquisition and release of a resource), and CWE-911. The immediate outcome is a kernel crash, which manifests as a denial of service to any processes that were running on the affected machine.

Any Linux kernel version that contains the fib_rules_dump routine prior to the patch is potentially vulnerable. All distributions shipping a default kernel include this code path; the exact affected version range is not specified, so systems running older kernels should be assumed at risk until the fix is applied.

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% suggests a low but non‑zero likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local or privileged user capable of invoking a network configuration change that triggers fib_rules_dump during a concurrent deletion of a fib_rule. All other claims regarding remote exploitation are inferred and not directly supported by the provided text.