The vulnerability comes from a race condition in the Linux kernel where the function nh_rt_cache_flush walks a list of nexthop structures without holding the required lock during a nexthop replacement. This race leads to a use‑after‑free, as evidenced by the slab-use-after-free diagnostic, and can corrupt kernel memory. The weakness involves improper locking and can be categorized as a use‑after‑free flaw.

All Linux kernel builds that include the original nexthop implementation and have not incorporated the patches in commits 44f53e4331a30fabc38a411fae7524341b618db3 and 4787a6d2629b4e8c0b6bacab1f75c1660eca44d9 are vulnerable. No specific version numbers are supplied, so any kernel based on the unpatched code remains susceptible until the fix is integrated.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% points to a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require triggering the race during a nexthop replacement that also involves concurrent route modifications. A successful exploit could corrupt kernel memory and potentially allow privilege escalation. Information about the necessary permissions to trigger the race is not explicitly provided, but typical privileged routing operations would be required.