The flaw is in the kernel’s net/sched: act_ife action, where a replace operation mistakenly appends metadata instead of replacing it. This error causes the metadata list to grow unbounded and can trigger an out‑of‑bounds write while encoding the list, resulting in a kernel panic. The weakness can be described as a buffer overrun (CWE‑120).

All Linux kernel versions that implement the act_ife action are affected, specifically those running prior to the patch that corrects metalist update behavior. Any system exposing this NetFilter action and running an unpatched kernel is at risk. The issue is kernel‑level, not tied to a specific distribution.

The CVSS score of 7.8 reflects high severity, but the EPSS score of less than 1% and absence from the KEV catalog indicate a low likelihood of active exploitation. The attack vector is inferred to be local or privileged: an attacker or privileged software that can add or modify traffic control rules using the ife action would trigger the bug. Remote exploitation without kernel access is unlikely based on the description.