The Linux kernel’s IPv6 routing stack contains a flaw that allows rt6_insert_exception() to create a new exception while a fib6_info object is simultaneously being removed, creating a reference cycle that leaks the fib6_info, its next‑hop device, and associated per‑CPU route information. This memory leak can stall network device unregistration and may lead to a denial‑of-service scenario on the affected system. The weakness is a classic memory‑leak bug (CWE‑401) and also involves improper handling of reference processes (CWE‑772).

Affected systems include any Linux kernel built before the commit that introduced the fix, across environments that rely on IPv6 route management. No specific version ranges are supplied in the advisory, so all kernels containing the vulnerable rt6_insert_exception() implementation are implicitly at risk.

Risk assessment indicates a moderate severity impact based on a CVSS score of 4.7, with an EPSS score of less than 1% indicating a low probability of exploitation. The vulnerability is not listed as a known exploited vulnerability by CISA. The likely attack vector is a privileged or local attacker able to manipulate IPv6 routing tables, or an attacker who can combine this flaw with another privilege‑escalation or remote‑code‑execution vector to invoke rt6_insert_exception() during device teardown.