The Linux kernel’s ipset subsystem contains a flaw in its bucket deletion logic, causing buckets that have become empty after all entries are removed to remain allocated. This results in wasted memory that can accumulate over time, potentially exhausting available memory and leading to kernel crashes or service interruptions.

All Linux kernel versions that include the netfilter ipset module and have not yet incorporated the commit that fixes the bucket release logic are affected. Users running older kernels on any distribution that ship an unpatched ipset implementation are susceptible to the potential resource exhaustion described.

The CVSS score and EPSS data are not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation. Based on the description, the likely attack vector is local or privileged code that exercises the ipset bucket deletion path. An attacker could repeatedly trigger bucket deletions to consume memory or force a kernel panic, resulting in a denial‑of‑service condition. The overall risk is moderate to high for environments that heavily rely on ipset configurations and have not applied the patch.