The Linux kernel’s netfilter IDLETIMER module can inadvertently reuse timer objects between rule revisions. When a revision 0 rule is added for a timer label that was previously established by revision 1 with the XT_IDLETIMER_ALARM flag, the code calls mod_timer on an uninitialized timer structure. This misuse can trigger debugobject warnings and, if panic_on_warn is enabled, lead to a kernel panic, effectively denying service to the system. The flaw is a misuse of an uninitialized resource, as cataloged by CWE‑908.

The vulnerability is present in any Linux distribution shipping the kernel code that implements the xt_IDLETIMER module without the applied fix. No specific kernel version is listed in the advisory, thus all builds that use the affected kernel source remain potentially vulnerable until the patch is applied.

The CVSS score of 7.8 signals high severity, but the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The probable attack vector is local; an attacker with root or the ability to manipulate netfilter rules could trigger the failure. Because the bug causes a kernel panic, successful exploitation translates into a denial of service, but it does not compromise data confidentiality or integrity. The vulnerability is not identified in the CISA KEV catalog, suggesting no publicly known exploits exist at this time.