The flaw resides in the Linux kernel’s nf_tables component, where a flowtable can be freed before a required RCU grace period when an error occurs during hook deregistration. This results in a use‑after‑free condition that exposes freed kernel memory to packet processing and nfnetlink control‑plane paths. An attacker capable of repeatedly triggering this rare error path—such as by forcing the maximum hook count or inducing a hardware offload failure—could corrupt kernel memory, crash the system, or potentially execute arbitrary code if they can control the freed memory contents.

All Linux kernel implementations that include the nf_tables module are affected. The vulnerability is not tied to a specific kernel version, so any distributions running an unpatched kernel that contains this code path remain vulnerable until a corrective update is applied.

The CVSS score of 7.8 indicates high severity, while an EPSS score below 1 % suggests exploitation is unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires precise control of kernel‑level operations to trigger the hook‑registration error; once triggered, the use‑after‑free can lead to memory corruption, denial of service, or privilege escalation, making the overall risk high if the attack conditions can be met.