The vulnerability arises from a flaw in the nft_set red‑black tree code, where open intervals that lack an explicit end element are not properly validated against existing intervals. This omission can cause the kernel to miss a partial overlap between a new interval’s start and an existing interval’s start, potentially allowing a misuse of the nftables rule set to accept duplicate or incorrect entries. As a result, the integrity of nftables configurations can be compromised, which may lead to unintended packet filtering behavior or rule addition failures, but no direct remote code execution or memory corruption is disclosed.

All Linux kernel implementations that include nftables and are running a kernel build before the patch that adds the proper open‑interval validation. The affected vendor is Linux, as listed in the CNA data, and the problem applies to any kernel version that contains the unpatched nft_set_rbtree logic; the specific versions are not enumerated in the advisory.

The advisory assigns a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1 %, indicating a low likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Based on the nature of the code changes, the attack vector is inferred to be local or privileged, requiring the ability to modify nftables rule sets. The exploitability is limited by the need for direct interaction with the kernel’s nft_set implementation, and no evidence of a publicly available exploitation method is provided.