In the Linux kernel, the nfnetlink_log subsystem was found to mis-handle the NLMSG_DONE message by accounting only for the size of the netlink attributes and ignoring the full netlink header length. When a malformed or oversized header arrives, the kernel produces a WARN splat and drops the message, but no code execution, data corruption, or other serious effects occur.

Any Linux system running a kernel version prior to the inclusion of the patch that accounts for the full netlink header size is affected. This includes the kernels referenced by the CPE strings (e.g., 7.0 rc1 through rc7). Distributions shipping these kernels without applying the patch are at risk until they upgrade to a newer kernel release.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. No listing in CISA KEV further indicates limited real world exploitation. Based on the description, it is inferred that the attacker would need the ability to construct and send crafted netlink messages, which typically requires local or privileged user access. If successful, the attacker could repeatedly trigger WARN splats and cause legitimate netlink traffic to be discarded, potentially disrupting logging or monitoring flows but not compromising system integrity or confidentiality.