The Linux kernel contained a vulnerability in the IPv6 multicast routing subsystem where ip6mr_cache_report() cloned a destination cache entry (dst) that could have been freed due to race conditions involving multicast forwarding cache misses and route deletions. Specifically, when an ingress multicast packet misses the MFC lookup, the packet is queued unresolved, escaping the receive-side RCU grace period. If the underlying route is deleted and freed, subsequent processing could invoke dst_clone() on a freed dst, causing a slab use-after-free. The fix removes the dst_clone() call and drops the dst reference before queuing unresolved packets, ensuring no use-after-free occurs.

Exploitation of this vulnerability could lead to use-after-free memory corruption in the kernel, potentially allowing an attacker with local privileges to cause system crashes or escalate privileges. The CVSS score of 7.8 indicates high severity with impacts on confidentiality, integrity, and availability. However, exploitation requires local access and low complexity.

A fix is available that removes the unsafe cloning of the dst entry and ensures that report packets do not hold a dst reference. Users should update their Linux kernel to a version that includes this patch. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. No additional mitigations are specified.