An unprivileged user can trigger a NULL pointer dereference in the Linux kernel’s IPv6 netfilter rpfilter module by creating a route that has no inet6_dev. When the kernel attempts a rpfilter lookup on such a route, the null dereference causes a kernel panic, abruptly terminating the operating system and denying all services. This vulnerability is a classic memory safety flaw that leads to direct system crash.

The affected product is the Linux kernel, maintained by the Linux community. The vulnerability exists in all versions of the kernel prior to the fix, with no specific version range documented. The primary impacted component is the IPv6 netfilter rpfilter module that processes inbound IPv6 traffic in the kernel.

The CVSS score is 7.0, indicating moderate severity. The EPSS score is < 1%, suggesting low exploitation probability. The vulnerability is not listed in CISA KEV. An unprivileged user can trigger a kernel panic by creating a route without an inet6_dev and causing a null pointer dereference during rpfilter lookups. When executed, the null dereference causes a kernel panic, abruptly shutting down the operating system and causing denial of service. The likely attack vector is through manipulating routes via rtnetlink in a private network namespace. Attack prerequisites include kernel access and the ability to add routes, and the attack path involves constructing the state, triggering the lookup, and causing the crash.