The flaw occurs when the kernel updates RCU‑protected IPv6 multicast lists with plain pointer assignments instead of the required rcu_assign_pointer function. This race allows a concurrent reader to access a list entry that may have been unlinked or reordered, resulting in a use‑after‑free or corrupted traversal of the list. The affected code paths include __ipv6_dev_mc_dec, ipv6_sock_mc_drop, __ipv6_sock_mc_close, __ipv6_sock_mc_join, and other multicast management functions.

The issue is present in the Linux kernel itself; any build that has not incorporated the patch that switches all multicast list updates to rcu_assign_pointer is affected. Users should verify whether their running kernel predates the commit referenced in the provided Git URLs. All Linux distributions shipping kernels without this change are susceptible to the race condition.

Exploitation requires a timing race between a process that modifies multicast list links and another that reads those lists under rcu_read_lock. No public exploits are known and EPSS is unavailable, indicating a low exploitation probability. If an attacker succeeds, the race could cause kernel memory corruption, potentially leading to a crash or privilege escalation. The vulnerability is not listed in the CISA KEV catalog, reinforcing its lower threat grade. Prompt patching is advised to mitigate the risk.