In the Linux kernel IPv6 stack, a race condition between RTM_NEWROUTE processing and a concurrent ignore_routes_with_linkdown update causes rt6_multipath_rebalance to compute a zero total weight in its first pass but then attempt to divide by that zero in a second pass. The division by zero triggers a kernel panic through rt6_upper_bound_set, which appears as an Oops and brings the system down. The flaw is a classic divide‑by‑zero bug and a race condition that can result in a denial of service.

The vulnerability is present in the Linux kernel, affecting all builds that have not yet incorporated the upstream patch. The specific product is the Linux kernel; no vendor version range is listed, so any kernel lacking the fix is potentially vulnerable. The fix was deployed in a commit that modifies the route calculation logic to skip upper‑bound calculation when the first pass reports a zero total.

No CVSS score or EPSS data is provided, and the vulnerability is not listed in the CISA KEV catalog, leaving the quantitative risk unclear. Because the fault occurs during netlink processing of IPv6 routing updates, the most likely exploitation path would involve an attacker able to send malformed routing messages to a target kernel, which may be local or remote depending on firewall and kernel configuration. The division‑by‑zero panic can crash the kernel, leading to service disruption. Until an update is applied, the vulnerability remains exploitable under the inferred attack scenarios.