The vulnerability resides in the Linux kernel's IPv6 routing subsystem. A suppressed route is removed but its internal destination pointer is not cleared. If no new rule replaces it, a lookup later returns the stale pointer, allowing the kernel to dereference freed memory. This use‑after‑free can trigger a kernel panic or other unintended behavior, effectively denying service to the affected system.

All Linux kernel configurations are potentially affected. The CVE does not list specific kernel releases; the issue exists in any build that contains the unpatched fib6_rule_suppress implementation prior to the applied change.

The CVSS score is 9.8, and the EPSS score is < 1%. The vulnerability is listed as not in CISA KEV, indicating no confirmed public exploits yet. The attack vector is not explicitly described, but since the flaw lies in the kernel IPv6 stack, it is inferred that a malicious actor could craft special IPv6 routing messages to trigger the bug and cause a crash. The lack of a public exploit does not eliminate risk, as local or privileged attackers could exploit it. The high potential impact combined with the absence of mitigation guidance suggests that the threat is significant if the system is exposed to externally controlled IPv6 traffic.