The Linux kernel contains a race condition in the IPv6 address configuration code. During Duplicate Address Detection (DAD), the function addrconf_dad_failure temporarily releases the interface lock, allowing a concurrent ipv6_del_addr call to change the interface state to DEAD and remove the address list entry. When addrconf_dad_failure resumes, it overwrites the DEAD state with ERRDAD and schedules a new work item that again invokes ipv6_del_addr on the already‑removed entry. This mis‑ordering causes a general‑protection fault and brings the kernel down, resulting in a denial‑of‑service via kernel panic.

Any Linux kernel that includes the buggy ipv6 addrconf module is affected. No specific version range is listed, so any build that incorporates this code path could be impacted. The CNA lists the product as Linux:Linux.

The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is 9.8. The flaw is triggered by a race between addrconf_dad_failure and ipv6_del_addr, which generally requires an attacker to influence IPv6 address configuration on the host. Based on the description, it is inferred that local or privileged access would be needed to orchestrate the concurrent operations that lead to the kernel crash. No known exploits are reported in the wild.