The Linux kernel’s netfilter IDLETIMER extension can reuse timer objects across rule revisions, and when a revision 0 rule is added for a label that was previously registered as an ALARM timer, the kernel calls mod_timer on an uninitialized timer structure. The resulting use‑after‑free type bug triggers debugobject warnings and can crash the kernel if panic_on_warn is enabled, thereby causing a denial of service. The weakness corresponds to CWE‑908, a race or misuse of an uninitialized resource.

The vulnerability affects the Linux kernel’s netfilter subsystem, specifically the xt_IDLETIMER module, and impacts all distributions that ship the affected kernel code. No specific kernel versions are listed, so users of any kernel build without the patch are potentially vulnerable.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The attack vector is likely local, requiring a privileged user to insert firewall rules that trigger the bug. Since the issue results in a kernel panic, a successful exploitation would lead to system downtime. The vulnerability is not listed in the CISA KEV catalog, so no known public exploits have been documented.