During the handling of IPv4 routing updates, the Linux kernel performs sizing for route notifications. The implementation uses an RCU-only helper that checks the number of paths in a nexthop group before iterating, while independently reloading the group pointer. If a route change replaces a group with fewer paths between these loads, the helper may return null, and the notification sizing function dereferences a null pointer. This race condition can cause the kernel to terminate unexpectedly, resulting in a denial of service.

All Linux systems that use the kernel code path implementing IPv4 route notifications with concurrent nexthop group updates are affected. The issue exists in kernel versions that include commit 680aea08e78c preceding that fix, and it is addressed in later releases. No specific vendor or product versions are listed beyond the generic Linux kernel.

Exploitability requires the ability to trigger a route update that causes the nexthop group to shrink during notification sizing. An attacker with local privileges can manipulate the routing table to create such race conditions. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Because the defect leads directly to a kernel crash, the risk is high for affected systems when the scenario is achieved.