A flaw in the Linux nf_tables subsystem causes the kernel to incorrectly handle pending catchall elements during transaction processing. When a map holding catchall elements is removed, only the first viable element is toggled, leaving other elements in an inconsistent state. This leads to a warning in the kernel log and can ultimately trigger a fatal condition that crashes the kernel, resulting in a temporary loss of service.

All Linux kernel installations that load the nf_tables module are affected. The vulnerability applies to every version of the kernel until the patch commit is incorporated, as indicated by the CPE for the linux_kernel family. Administrators should verify whether the running kernel contains the specific commit that addresses the issue.

The CVSS score of 7.8 signals a high severity vulnerability, yet the EPSS probability is below 1 %, implying a low likelihood of current exploitation. The flaw is not present in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to send crafted netlink messages to nf_tables, indicating a local or privilege‑escalation attack vector. Successful exploitation results in a kernel crash, but real-world exploitation remains unlikely until a proof‑of‑concept is demonstrated.