The vulnerability in the Linux kernel causes a use‑after‑free condition in the IPv6 nexthop handling code. During a run‑time NETLINK (RTNL) serialized nexthop replacement, the f6i_list of a nexthop is walked without holding its lock, whereas concurrent route deletions may unlink and free the related fib6_info. The race leads to KASAN reports of out‑of‑bounds reads and can trigger a kernel crash, providing an avenue for denial of service or exploitation of kernel memory if the attacker can control the payload.

All systems running the Linux kernel version that contains the unprotected f6i_list walk are affected. The issue resides in the core IPv6 routing subsystem, so every kernel release before the patch in the maintainers’ commit is vulnerable. Until a patched kernel is deployed, machines with the affected kernel are subject to this flaw.

The CVSS score of 8.8 is disclosed; the use‑after‑free nature and resulting kernel crash imply a high severity impact. EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to modify routing tables, which requires CAP_NET_ADMIN or equivalent privileged local access. The likely attack vector is privileged local or, in environments that allow route manipulation, potential remote exploitation through compromised administrative privileges.