The flaw is a memory leak in the Linux kernel’s nftables nft_dynset module. When cloning a second stateful expression fails, the first remains allocated and is never freed, creating an unreferenced per‑CPU object. If an attacker can repeatedly trigger this error path, the unreleased objects accumulate, exhausting kernel RAM and potentially destabilising the system, leading to denial of service.

All Linux kernel releases that include the vulnerable nftables nft_dynset code before the patch are affected. The specific product is the Linux kernel’s nftables subsystem; no particular vendor version was specified in the advisory.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through manipulated nftables rules or crafted network traffic that forces the clone operation to fail, a scenario that is inferred from the error path described; this inference requires privileged or local control of nftables. As a result, exploitation would most readily occur from a local attacker with sufficient privileges, while remote exploitation is unlikely without additional privileges.