This kernel flaw arises when functions that create IPsec bundles read a network device pointer without holding a reference. A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old net_device, causing a stale pointer to be later dereferenced during destination resolution. The likely attack vector is a race condition triggered by concurrent interface deletion while IPsec bundle creation occurs, which can lead to use‑after‑free, kernel memory corruption, or a system crash. The weakness is a classic dereference vulnerability coupled with a concurrent modification race.

All Linux kernel installations that have not yet applied the fix for the 2026‑98364 bug are affected. The advisory does not list specific kernel releases, so any kernel version lacking the patch could be vulnerable.

The CVSS score of 7.8 indicates high severity, yet the EPSS score of < 1% suggests a very low probability of exploitation in contemporary settings. The bug is not listed in the CISA KEV catalog, implying no large‑scale exploitation has been observed. The likely attack vector is the race condition between interface deletion and IPsec bundle creation, and if successfully triggered, an attacker could achieve kernel memory corruption or denial of service, maintaining a high severity assessment but low exploitation likelihood.