During removal of a multicast source filter whose count reaches zero, the function ip6_mc_del1_src() unlinks a source filter from the active list and inadvertently moves its reference into a tombstone list that is also accessed locklessly under Read-Copy-Update. Because the next pointer of the source filter is changed before the RCU grace period ends, concurrent readers may be diverted into the tombstone list and miss remaining active source entries, leading to incorrect evaluation of multicast destinations. No evidence of direct exploitation to create a direct denial‑of‑service or compromise in the supplied description, but the improper list traversal could cause protocol misbehaviour that may be leveraged in a crafted traffic scenario. The weakness represents a race condition that could lead to stale or missing data in multicast processing.

All Linux kernel installations susceptible to the bug; the affected code resides in the IPv6 multicast subsystem. The fix has been applied in recent kernel revisions, so any kernel prior to that revision is potentially vulnerable. As vendor, the Linux kernel is maintained by the Linux community and the applicable patch is available through official kernel release channels.

The CVSS score is not provided and the EPSS score is unavailable, so the concrete exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits at the time of this record. Inferring from the description, the attack vector would likely be a local or network attacker who can send crafted IPv6 multicast packets that trigger the removal of a source filter. Successful exploitation could cause misclassification of multicast traffic or a local denial of service in the multicast subsystem, potentially affecting application availability that relies on multicast. The absence of a public exploit does not diminish the need for patching, given the possibility of a zero‑day or otherwise undisclosed vulnerability.