In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: clear suppressed fib6 rule result

fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
but leaves res->rt6 pointing at the released rt6_info.

If no later rule supplies a replacement, fib6_rule_lookup() still sees
res.rt6 and returns that stale dst to its caller. A suppressing rule can
therefore leak a released route back to rt6_lookup(), and the next put
hits rcuref_put_slowpath() from dst_release().

Clear res->rt6 when suppressing the route so suppressed lookups fall
through to the null dst instead of reusing the released one.

https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc

https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f

https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7

https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa

https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb

https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3

https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937

https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/fib6_rules.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"209d35ee34e25f9668c404350a1c86d914c54ffa","lessThan":"90c57310e266eb94e4a80d6b15a9ca131d2e82cb","versionType":"git","status":"affected"},{"version":"8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383","lessThan":"5d29b286c9de0b309e94b9ed083aa1a2f429434f","versionType":"git","status":"affected"},{"version":"cdef485217d30382f3bf6448c54b4401648fe3f1","lessThan":"354db6243eca59e9d187ffbf8b7955b044ce84dc","versionType":"git","status":"affected"},{"version":"cdef485217d30382f3bf6448c54b4401648fe3f1","lessThan":"6d98c70fe0ba8c7708bfd5b2a5174d2086775daa","versionType":"git","status":"affected"},{"version":"cdef485217d30382f3bf6448c54b4401648fe3f1","lessThan":"9bad152c42b37499162367fe47867411e62fffa3","versionType":"git","status":"affected"},{"version":"cdef485217d30382f3bf6448c54b4401648fe3f1","lessThan":"dc3ab04220667f254f4348572b2a0b3febff89fb","versionType":"git","status":"affected"},{"version":"cdef485217d30382f3bf6448c54b4401648fe3f1","lessThan":"a341c091ca0bfae377747b1b59a3bd8ebe18a937","versionType":"git","status":"affected"},{"version":"cdef485217d30382f3bf6448c54b4401648fe3f1","lessThan":"6aea62e433fe1b586202a5fee8b5807ce635e1d7","versionType":"git","status":"affected"},{"version":"ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29","versionType":"git","status":"affected"},{"version":"5.10.84","lessThan":"5.10.265","versionType":"semver","status":"affected"},{"version":"5.15.7","lessThan":"5.15.216","versionType":"semver","status":"affected"},{"version":"5.4.164","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/fib6_rules.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]