Linux Kernel EUVD-2026-39305

Exploitation requires a local process with CAP_NET_ADMIN capability (or equivalent access in a network namespace, which is automatically granted to processes in a new user+network namespace on many Linux distributions). IPv6 must be enabled on the host, which is the default configuration on virtually all modern Linux systems. The trigger is the deletion of an IPv6 address via rtnetlink whose prefix route resolution returns the fib6_null_entry sentinel - this requires a specific address/prefix state that may not be trivially reproducible in all configurations, though the CVSS AC:L rating suggests no special race condition or complex precondition is required once CAP_NET_ADMIN is held. Exploitation is limited by: (1) mandatory local access - no network-adjacent or remote vector exists; (2) requirement for CAP_NET_ADMIN, which limits exposure to privileged users, container runtimes with elevated capabilities, or systems with permissive capability assignments; (3) impact is availability-only (kernel crash) with no data exfiltration or integrity modification possible.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (score 5.5 Medium) accurately reflects real-world risk: exploitation requires local presence and at minimum CAP_NET_ADMIN, which is a meaningful barrier. There is no remote attack vector, no confidentiality or integrity impact, and the outcome is a kernel panic (availability loss). EPSS at 0.17% (6th percentile) corroborates that exploitation is unlikely to be widespread; this is not a remotely triggered or authentication-free vulnerability. The Linux kernel's ubiquitous deployment means the absolute population of potentially affected systems is enormous, but the practical risk is confined to threat models involving privileged local users, compromised containers with elevated network capabilities, or multi-tenant environments where CAP_NET_ADMIN may be granted more broadly. There is no KEV listing and no POC referenced in available data. The CVSS score and EPSS signals are consistent and non-conflicting: this is a legitimate but lower-priority patching item for most enterprise environments, elevated in priority for container orchestration platforms or systems where CAP_NET_ADMIN is delegated to untrusted workloads.

A local user or process holding CAP_NET_ADMIN (for example, a containerised workload granted NET_ADMIN capability) constructs and transmits a DELADDR rtnetlink message requesting deletion of an IPv6 address whose corresponding prefix route resolves to the fib6_null_entry sentinel. The kernel's cleanup_prefix_route() dereferences the sentinel's NULL fib6_table pointer while attempting to acquire the table's spinlock, triggering a general protection fault detected by KASAN and causing an immediate kernel panic, crashing the entire host. No POC is publicly documented at the time of this analysis.