important · Privilege — Linux
An unprivileged Linux process can turn stale IPv6 multicast-routing state into kernel execution.
Affects
The Linux kernel IPv6 multicast-routing subsystem on Linux hosts.
An unresolved multicast packet can retain a route destination beyond RCU protection; after the route is deleted, a wrong-parent resolution makes ip6mr_cache_report clone the freed destination.
Detail and 2 sources
The upstream fix addresses that sequence, but we do not have a public exploit, a reliability demonstration, or a complete affected stable-version matrix.