In the Linux kernel’s IPv4 ICMP handling, when a forward route cannot be used, the lookup falls back to a reverse‑path search that re‑examines the packet’s source address. If this reverse path yields an unreachable route (RTN_UNREACHABLE), the kernel mistakenly treats it as a valid output route, eventually triggering the ip_rt_bug() routine and emitting a WARN_ON_ONCE warning. The symptom is a defensive kernel warning; the flaw does not crash the kernel, the userspace, or grant code execution.

All Linux kernel releases that do not contain the commit that rejects RTN_UNREACHABLE input routes are affected, regardless of distribution. The specific affected versions are not enumerated in the advisory, but any kernel older than the fix commit is vulnerable.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score is reported as <1% and the issue is not listed in CISA’s KEV catalog, pointing to a low likelihood of exploitation. An attacker would need to craft ICMP packets that trigger the reverse‑path logic over the network; the impact is limited to kernel warning logs and does not provide privilege escalation, denial of service, or other exploitability. The likely attack vector is remote ICMP traffic over the network.