A use-after-free vulnerability in the Linux kernel nexthop subsystem may allow a local attacker to execute arbitrary code or cause a system crash.

The vulnerability occurs because nh_rt_cache_flush performs an unlocked walk of the f6i_list while the list is being modified by concurrent IPv6 route operations. This race condition allows a local authenticated user to trigger a use-after-free scenario.

Exploitation of this vulnerability allows a local user with low privileges to escalate their access or cause a denial of service by crashing the kernel. With a CVSS score of 8.8, this flaw poses a severe risk to multi-tenant environments or systems where untrusted users have local access, as it can lead to full system compromise.

Immediate Action: Apply the latest kernel security updates, ensuring the kernel is updated to at least version 7.1.8.

Proactive Monitoring: Utilize kernel auditing tools to monitor for suspicious process behavior or unexpected kernel memory access errors.

Compensating Controls: Enforce strict access control policies to limit the number of users capable of executing network configuration commands that interact with the nexthop subsystem.

Public Exploit Available: No

Given the potential for privilege escalation and system-wide impact, immediate patching is essential. Organizations should update their Linux kernel deployments to 7.1.8 to ensure the nexthop locking mechanisms are correctly implemented.