The Linux kernel’s IPv6 multicast source filtering routine mutates the source filter list in place while other threads may be reading that list under an RCU read lock. Based on the description, it is inferred that the vulnerability can be exploited by creating a race condition between ip6_mc_source (writer) and inet6_mc_check (reader), which may occur during simultaneous multicast traffic processing. Because 16‑byte IPv6 address writes are not atomic and the array is shifted without synchronization, concurrent readers can observe torn or duplicated IPv6 addresses and missing entries. This can lead to corrupted multicast source filtering, potentially causing the kernel to misinterpret source addresses and disrupt multicast traffic.

The vulnerability exists in all Linux kernel builds containing the unpatched ip6_mc_source() implementation. Affected vendors include the Linux kernel maintainers; affected versions are those released before the commit that introduced copy‑on‑write RCU updates (e.g., the snapshot before commit 20db91a052332ef5). No specific patch level is listed, so kernels up to the corresponding release are impacted.

The CVSS score is 4.4 and the EPSS score is < 1%, indicating limited risk of widespread exploitation. Based on the description, it is inferred that the vulnerability requires concurrent read/write activity on multicast source filters, which can be triggered by normal multicast traffic patterns. This makes the attack vector a local race condition rather than an externally craftable packet. Because it is a race condition that leads to corrupted data rather than immediate code execution, the risk is assessed as low to moderate. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported.