The Linux kernel’s IPv6 output path contains a use‑after‑free bug. ip6_finish_output2() stores a pointer to the destination address (daddr) before calling lwtunnel_xmit(). In some LWT‑BPF or other encapsulation code paths, lwtunnel_xmit() can reallocate the socket buffer head, freeing the memory that daddr references. After the call returns with LWTUNNEL_XMIT_CONTINUE, ip6_finish_output2() continues to use the stale daddr pointer to compute the next hop, update the neighbour cache, and perform lookups. This stale pointer can be read, allowing an attacker to read arbitrary kernel memory, corrupt the neighbour table with arbitrary values, misdirect traffic, or trigger a kernel panic.

All Linux kernel builds are potentially impacted because the affected code exists in the mainline kernel. No specific distribution or version numbers are listed, so any machine running a Linux kernel prior to the patch that implements this fix is at risk.

Although the CVE does not supply a CVSS or EPSS score, the bug involves kernel memory corruption that could be triggered by network traffic containing specially crafted IPv6 packets. If an attacker can send such packets to a vulnerable host, they could cause a read of sensitive memory, corrupt the neighbour cache, or crash the system. No known public exploits are listed and the vulnerability is not in the CISA KEV catalog, indicating that exploitation may not yet be widespread but remains possible.