The vulnerability resides in the nf_tables module of the Linux kernel. An incorrect activity check in nft_map_catchall_activate() causes the function to process already active map elements while skipping those that are inactive. This logic flaw prevents the restoration of reference counts for chain objects when a DELETE set (DELSET) operation is aborted, leading to a use‑after‑free condition on the nf_tables chain structure. An attacker can trigger the crash by performing an aborted DELSET via user namespaces and nftables, and the resulting use‑after‑free can be leveraged for local privilege escalation.

All Linux kernel releases that include versions 6.19 rc1 through rc8 and kernel 6.4, when built with the CONFIG_USER_NS and CONFIG_NF_TABLES options enabled. The bug is present in every Linux kernel that contains the nf_tables module without the subsequently applied patch.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at any given time. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. The attack requires local access to a system that allows creation of user namespaces and use of nftables, making it a local privilege escalation vector rather than a remote one. Once exploited, the use‑after‑free can lead to arbitrary code execution or system compromise by the attacker. The fix removes the incorrect negation in the activity check, restoring correct reference counting and eliminating the use‑after‑free.