The vulnerability resides in the Linux kernel’s in6_dev_get() function, which reads an IPv6 device pointer under RCU and then increments its reference counter without checking if the object has already been freed. If the device has been torn down in the interim, the increment resurrects a structure whose RCU free has been queued, allowing callers to dereference memory that has already been freed. The resulting use‑after‑free can corrupt kernel memory or cause a crash, potentially enabling an attacker to execute arbitrary code with kernel privileges. This flaw is a classic Use‑After‑Free and also exemplifies improper resource release vulnerabilities (CWE‑825).

The flaw affects any Linux kernel that implements the legacy in6_dev_get() routine prior to the commit that replaces refcount_inc() with refcount_inc_not_zero(). It has been reproduced against the unpatched v7.2‑rc3 kernel, indicating that all kernels using this legacy path until the patch is applied are vulnerable.

The CVSS score of 7.8 reflects a high impact, while the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known exploits exist. The likely attack vector is manipulating IPv6 operations during a device teardown, which is not trivial but could be engineered by a privileged or sophisticated attacker to trigger the use‑after‑free and potentially compromise the system.