An ARP handling bug in the Linux kernel allows malicious network traffic to trigger a null pointer dereference that causes a kernel panic. The flaw arises because netfilter's x_tables extensions register match and target functions using NFPROTO_UNSPEC, but validate their hook usage against NF_INET_* constants. These constants misalign with the three ARP hook indices, permitting match or target code to run on ARP chains where its assumptions (such as state->in being set) are invalid. A concrete example is the xt_devgroup module, which dereferences a pointer that is null in the ARP context, leading to a general protection fault. The kernel crash manifests as a fatal exception in interrupt and results in a denial‑of‑service condition.

The vulnerability is present in the Linux kernel's netfilter x_tables subsystem for all releases that have not yet applied the security commit rectifying NFPROTO_ARP extension restrictions. Affected users run any Linux kernel prior to the patch release, regardless of distribution, as the problem is in the core kernel. Versions after the commit that introduces the restriction are not impacted.

The CVSS score for this defect is 5.5, indicating moderate severity. The EPSS score of <1% shows a very low probability of exploitation, yet the vulnerability remains exploitable via crafted ARP traffic. The flaw causes a kernel panic when ARP packets trigger a null‑pointer dereference in the netfilter subsystem, resulting in denial of service. It is not listed in CISA KEV. The likely attack vector is any network host sending malformed ARP messages to a host whose ARP filter includes the vulnerable extension.