The vulnerability is a race condition in the IPv4 routing notification code. When a notification is emitted, the kernel pre‑allocates a socket buffer based on an initial size snapshot. A concurrent operation that modifies the nexthop group can enlarge the group after the snapshot but before the buffer is filled. As a result the fill routine may detect that the buffer is too small and return -EMSGSIZE. The commit that fixed the issue removes the warning, but the existing error path still frees the buffer and reports the error. If the race is repeatedly triggered a kernel could become unstable or refuse to process route changes, causing a denial of service.

Affected builds are any Linux kernel versions that include the asynchronous notification path outlined in the commit but have not yet incorporated the race‑condition fix (commit 680aea08e78c). That includes all kernels released before the introduction of that commit and any custom or vendor‑modified kernels that have not applied the fix. The change applies to the core Linux kernel and not to a specific distribution, so any distribution using an affected kernel is subject to the issue.

The CVSS score of 4.1 and an EPSS score of <1% indicate a low but non-zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a privileged local user who can generate concurrent routing changes, such as a root process or a setuid utility. The impact is confined to system availability; the flaw does not provide remote code execution or confidentiality compromise.