In the Linux kernel nf_tables subsystem, a race condition occurs when a set reaches its maximum capacity. The implementation increments the element counter before inserting a new entry, and then immediately removes that entry without waiting for the RCU grace period. A concurrent RCU reader may traverse the newly added element before it is fully cleaned up, potentially dereferencing freed memory and corrupting kernel data. This flaw can lead to a kernel crash, system instability, or facilitate further attacks if memory corruption is leveraged.

All Linux kernel releases that include the nf_tables module prior to the patch commit are potentially vulnerable. The available CPE data shows affected kernels in the 4.10 series and the 7.0 release candidates. Any kernel version that ships with a full nf_tables configuration without the bug fix is at risk.

The CVSS base score of 7.8 classifies this issue as high severity, while the EPSS score of less than 1 % indicates a very low current exploitation probability. The vulnerability is not listed in CISA's KEV catalog, implying that no publicly known exploits have been reported. The likely attack vector is a local attacker or a compromised application that can insert entries into a nf_tables set, possibly through privileged system commands or scripts. While the CVE description does not explicitly state the attacker context, a local or elevated process would be required to trigger the race condition.