The Linux kernel’s IPv6 stack contains a flaw in the __in6_dev_stats_get() function, which can dereference a NULL pointer when the network device it queries has been unregistered. This triggers a kernel fault, potentially causing the system to crash or disrupting networking. The weakness is quantified with a CVSS base score of 7.5, indicating a high risk of denial of service.

All Linux kernel builds that expose the vulnerable __in6_dev_stats_get() implementation, that is, all releases before the patch that added the null check. This includes any distribution’s Linux kernel that has not yet been updated to include the commit introducing the guard.

The CVSS score is 7.5, the EPSS score is below 1%, and the vulnerability is not listed in KEV. Based on the description, it is inferred that exploiting the flaw requires reaching the code path that calls __in6_dev_stats_get() after a device has been unregistered, which typically demands local or privileged execution. The impact of a successfully triggered fault would be a kernel panic or service interruption, but the low exploitation probability and need for preconditions make real‑world attacks unlikely at present.