In the Linux kernel nf_tables subsystem a race condition arises when a set reaches its maximum capacity. The code increases the element counter before inserting a new entry and then removes that entry without awaiting the RCU grace period. If an RCU reader starts traversing the set while the freshly added element is being removed, it can dereference freed memory, potentially corrupting kernel data or causing a crash. The outcome is a denial of service due to kernel instability or a memory-corruption condition that could be leveraged for further compromise.

Linux kernel versions that ship the nf_tables module before the reported patch, including the 4.10 series (rc6, rc7, rc8) and the 7.0 release candidates (rc1, rc2). All kernels that incorporate this module without the fix are susceptible until the update is applied.

The CVSS base score of 7.8 marks this flaw as high severity, but the EPSS score of less than 1 % indicates a very low current exploitation probability. It is not listed in CISA’s KEV catalog, meaning there are no known public exploits. The most likely attack scenario requires a local or privileged process that can insert elements into an nf_tables set, such as an administrator running nft or iptables commands or a compromised application with sufficient rights. The vulnerability would need to be triggered by racing against an RCU reader, a scenario that is technically possible but may demand precise timing and in‑depth kernel knowledge.