The Linux kernel contains a flaw in the netfilter xt_multiport module where the ports_match_v1() routine mistakenly interprets any non‑zero flag as the beginning of a port range and consumes the next array element as the range end, even when the range encoding is malformed. Because the entry point that registers the rule does not validate that each range start is followed by a proper match end, an attacker can craft a rule that causes ports_match_v1() to read past the last valid element. This out‑of‑bounds read can trigger a kernel panic (Denial of Service) or result in mis‑applied packet‑filtering logic, potentially allowing traffic that should be blocked.

All Linux kernel configurations that have not incorporated the recent commit are vulnerable, regardless of distribution. This includes every released kernel version prior to the integration of the fix. Administrators should review whether their running kernel contains the patch referenced in the advisory commits and ensure that no legacy or custom builds remain in use.

The CVSS score of 5.5 indicates medium severity, and an EPSS score of less than 1% suggests a very low probability of exploitation at the time of reporting. The vulnerability is not listed in CISA KEV, implying no known public exploit. The most likely attack vector is local or administrative, as the flaw is triggered by injecting malformed rules into iptables or nftables, which typically requires privileged access. If an attacker were able to gain that privilege, they could cause a kernel crash or alter packet filtering behavior.