A race condition in the TCP IPv6 receive path allows an attacker to trigger a use‑after‑free scenario by concurrently closing a listening socket and sending packets to that socket. When the socket transitions to the CLOSED state, the kernel may mistakenly clone the skb with skb_clone_and_charge_r() before proper cleanup, leading to a null pointer dereference and a kernel panic, which results in a denial of service on the affected system.

All Linux kernel builds that include the unpatched tcp_v6_do_rcv() code are potentially vulnerable, regardless of distribution. The specific affected versions are not listed in the advisory, but any kernel before the commit that removes the race is at risk.

Because the flaw manifests when a socket is being closed by a benign or malicious process while packets are in flight, it could be triggered by an off‑site attacker via crafted network traffic if the host is exposed. The likely attack vector is sending crafted IPv6 packets to a listening socket during its closure. The risk is formally quantified with a CVSS score of 5.5 and an EPSS indicating less than 1% exploitation probability; the vulnerability is not listed in CISA KEV, suggesting no known mass exploitation yet. The high impact of a kernel crash and the potential for remote exploitation through network traffic make it a priority for patching.