An attacker who can manipulate IPv6 socket operations in a Linux kernel may trigger a use‑after‑free in the function in6_dev_get(). The code path reads an ipv6 device pointer under RCU and then unconditionally increments its reference counter even if the object has already been freed. This resurrects a stale object, allowing callers to use memory that has already been released, resulting in arbitrary memory corruption. The bug can cause KASAN reports of slab‑use‑after‑free and may be leveraged to crash the kernel or execute arbitrary code with kernel privileges.

The affected product is the Linux kernel. The vulnerability exists in releases that include the uncorrected code path before the patch that replaces refcount_inc() with refcount_inc_not_zero() in in6_dev_get(). It was reproduced against the unpatched 7.2‑rc3 kernel. All kernels containing this legacy implementation are considered vulnerable until the fix is applied.

The CVSS score is not provided, and the Exploit Prediction Scoring System score is unavailable; the assessment relies on the inherent severity of a use‑after‑free. This flaw can lead to kernel crashes or arbitrary code execution, giving it high impact potential. The attack requires manipulating the IPv6 subsystem and timing a device teardown, so exploitation is likely non‑trivial, yet the presence of KASAN traces indicates the vulnerability is correctly identified. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly observed exploits exist as of this analysis.