In the Linux kernel, a race condition allows a UDP output fallback path to clear the bind's local IP address while it is still being read locklessly by other network stacks. The cleared address can be observed in a torn state by an IPv6 reader, leading to invalid memory accesses, erroneous route lookups, and potential kernel crashes or instability. The underlying weakness is a concurrency issue that can result in memory corruption, as identified by CWE‑20.

All Linux kernel builds that contain the earlier bind-clearing logic are affected, regardless of distribution. The vulnerability is present until the specific commit that moves the bind update into a safe, lock‑protected location is applied. Any system running a kernel before the fixed release is at risk.

The EPSS score is reported as < 1%, indicating a low probability of active exploitation. No public exploits are known, and the vulnerability is not listed in CISA KEV. An attacker would need local or privileged access to generate concurrent UDP traffic that triggers the race condition. Because the flaw requires precise timing of UDP dispatch, the practical exploitability is limited, yet the risk remains theoretical and should be mitigated.