An ARP handling bug in the Linux kernel allows malicious network traffic to trigger a null pointer dereference that causes a kernel panic. The flaw arises because netfilter's x_tables extensions register match and target functions using NFPROTO_UNSPEC, but validate their hook usage against NF_INET_* constants. These constants misalign with the three ARP hook indices, permitting match or target code to run on ARP chains where its assumptions (such as state->in being set) are invalid. A concrete example is the xt_devgroup module, which dereferences a pointer that is null in the ARP context, leading to a general protection fault. The kernel crash manifests as a fatal exception in interrupt and results in a denial‑of‑service condition.

The vulnerability is present in the Linux kernel's netfilter x_tables subsystem for all releases that have not yet applied the security commit rectifying NFPROTO_ARP extension restrictions. Affected users run any Linux kernel prior to the patch release, regardless of distribution, as the problem is in the core kernel. Versions after the commit that introduces the restriction are not impacted.

The CVSS score for this defect is 5.5, indicating a moderate severity. Exploitability requires the attacker to send crafted ARP packets that are processed by a vulnerable arptables chain, which is typically available to network users. Since the issue results in a kernel crash rather than arbitrary code execution, the risk is lower for privilege escalation but still significant for availability. The problem is not listed in CISA's KEV catalog and no EPSS score is published, but the potential for automated ARP traffic to trigger a panic can be exploited remotely by a network adversary.