The Linux kernel’s ipset subsystem contains a flaw in its bucket deletion logic, causing buckets that have become empty after all entries are removed to remain allocated. This leads to wasted memory that can accumulate over time and may result in memory exhaustion, kernel crashes, or service interruptions.

All Linux kernel versions that include the netfilter ipset module and have not yet incorporated the commit that fixes the bucket release logic are affected. Users running older kernels on any distribution that ship an unpatched ipset implementation are susceptible to the potential resource exhaustion described.

The CVSS score is 5.5 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation. Based on the description, the likely attack vector is local or privileged code that exercises the ipset bucket deletion path. An attacker could repeatedly trigger bucket deletions to consume memory or force a kernel panic, resulting in a denial‑of‑service condition. The overall risk is moderate for environments that rely heavily on ipset configurations and have not applied the patch.