The Linux kernel contains a race condition in IPv6 multicast list handling: several functions incorrectly perform direct pointer assignments on RCU‑protected lists instead of using the required rcu_assign_pointer(). This can expose readers to list entries that have been modified or freed, leading to possible data corruption or crashes.

Any Linux kernel build that predates the commit sequence referenced in the supplied Git URLs is vulnerable. The issue exists in the core kernel source and therefore affects all distributions, custom kernels, and embedded systems that have not incorporated the patch that changes the multicast list operations to use rcu_assign_pointer() and the appropriate dereference helpers.

The flaw requires a timing race between a writer updating a multicast list and a reader traversing the same list under rcu_read_lock(). No publicly available exploits are known and the EPSS score is < 1 %, indicating a low likelihood of exploitation. The CVSS score of 4.7 reflects moderate severity, and the vulnerability is not listed in CISA KEV. Successful exploitation could trigger kernel memory corruption and a system crash; however, a clear escalation path is not documented in the description.