The vulnerability lies in the IPv4 FIB subsystem's fib_leaf_notify() routine, where it dereferences a fib_info structure that may have already been freed. The refcount functions called during an RCU dump are unsafe, leading to a classic use‑after‑free. This flaw can cause memory corruption and may allow an attacker to trigger a kernel crash or execute arbitrary code with kernel privileges.

All Linux kernel versions older than the patch that includes commits 06b693d2eb6651a63ad85bad8673de3b7d4edd6d and 676482da8d938ea72c26da0fc86af2d2ec238ab2. Any kernel that loads the netdevsim module, or drivers such as mlxsw_sp_router_fib4_event and rocker_router_fib_event, is directly affected because these call the vulnerable notifier. No specific release numbers are listed, so a conservative approach is to treat all pre‑fix kernels as vulnerable.

The CVSS score of 7.8 indicates a high‑impact kernel flaw. The EPSS score is < 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to trigger the notifier, potentially via crafted routing packets, malicious network traffic, or a malicious loadable module interacting with the FIB subsystem. Although no public exploits are known, the identified severity warrants prompt remediation.