The vulnerability in the Linux kernel involves the in6_dev_get() function, which reads dev->ip6_ptr under RCU and then unconditionally increments its reference count. Because device teardown can clear the pointer and drop the last reference between these operations, the increment can resurrect an object whose RCU free has already been queued. This results in use-after-free conditions where callers may access freed memory. The fix involves using refcount_inc_not_zero() to ensure the reference count is only incremented if the object is still valid, returning NULL otherwise. This pins the object safely for the caller and prevents resurrection of freed objects. The issue was reproducible on an unpatched kernel revision (v7.2-rc3) and was confirmed by memory sanitizer traces showing use-after-free and reference count underflow.

The vulnerability allows use-after-free conditions in the IPv6 networking code of the Linux kernel. This can lead to memory corruption, kernel crashes, or potentially privilege escalation if exploited. However, no known exploits in the wild have been reported. The impact is limited to affected kernel versions before the fix and affects kernel stability and security.

A fix has been implemented in the Linux kernel to address this vulnerability by modifying in6_dev_get() to use refcount_inc_not_zero() and return NULL if the object is already freed. Users should apply the official kernel updates that include this patch. Since no patch links or vendor advisories are provided here, users should monitor the official Linux kernel repositories or trusted vendor advisories for the fix. Patch status is not yet confirmed in this data — check the vendor advisory for current remediation guidance.