A flaw in the IPv6 segment routing implementation allows code that processes certain TIPC UDP bearer messages to invoke a function that lacks a valid network context. The missing check for a net pointer can cause a dereference of an invalid or null value, resulting in a kernel crash. This failure of validation means that an attacker capable of sending crafted IPv4‑segmented packets may be able to bring the system down, interrupting availability for all users.

The flaw affects the Linux kernel, specifically versions that include the segment routing (seg6) code but do not yet incorporate the patch that invokes skb_get_hash_net() in seg6_make_flowlabel(). All kernel releases prior to the commit that introduced the fix are vulnerable, regardless of micro‑version. No particular product family or vendor beyond Linux kernel is singled out.

The vulnerability is a classic null pointer dereference that leads to a kernel panic. It does not directly provide code execution or privilege escalation, but the impact on availability is significant. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet reported. However, because the bug is triggered via a TIPC UDP bearer message, it requires local or network access to craft the specific packet payload. The overall risk is moderate: it can be leveraged for denial of service if the attacker can reach the vulnerable system.