The Linux kernel’s nfnetlink_queue subsystem has a use‑after‑free flaw: a nf_queue_entry is freed with kfree while another CPU thread still traverses the list, resulting in a kernel panic as evidenced by the KASAN trace in nfqnl_recv_verdict. This memory corruption can abruptly terminate kernel execution.

All Linux kernel installations that ship the nfnetlink_queue module and have not applied the per‑queue hash table patch are affected. The advisory does not enumerate specific kernel versions, so every kernel prior to the fix is considered vulnerable.

The vulnerability is a high‑impact memory‑corruption bug that can cause a kernel crash. The CVSS score of 7.0 indicates moderate to high severity, and the EPSS score of < 1% shows low likelihood of exploitation; it is not listed in CISA KEV. The likely attack vector requires the ability to send crafted netlink messages to the nfnetlink_queue interface, so systems exposed to untrusted network traffic on this interface are at risk.