The kernel code that iterates over an RCU‑protected list of IPv6 neighbor exceptions uses an unsafe traversal primitive, allowing a concurrent insertion that produces a data race. The rt6_nh_dump_exceptions function holds rcu_read_lock but does not acquire rt6_exception_lock, so rt6_insert_exception can add a new entry while the list is being read. Kernel Concurrency Sanitizer reports this race, indicating that corrupted list pointers can cause invalid memory accesses. If the race occurs during a user‑initiated IPv6 route dump, the kernel may crash or show corrupted routing data, leading to loss of availability and incorrect network behavior.

Linux kernel, all versions containing the rt6_nh_dump_exceptions routine before the patch. No specific version range is provided, so the issue exists in any 7.x or later kernel until the fix is applied.

No CVSS score or EPSS value is provided; the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a local or low‑privilege user able to trigger a netlink route dump command (e.g., "ip -6 route list"). Because the faulty traversal occurs in the kernel, a successful exploitation would most likely result in a crash or corrupted routing state, which constitutes a denial‑of‑service impact. The lack of a public CVSS score and EPSS makes quantifying the likelihood difficult, but the race condition is a concurrency bug that could be triggered by ordinary user actions on affected kernels.