The vulnerability is a race condition in the netfilter nft_counter subsystem where simultaneous dump and reset operations are performed without proper synchronization. If two resets occur concurrently, they can each read the same counter totals and subtract them twice, resulting in counters that are lower than the actual values. Based on the description, it is inferred that an attacker with local or kernel-privileged access could trigger this race, causing inaccurate accounting of network traffic, potentially misleading administrators about traffic volumes and patterns.

All Linux kernel installations that include the netfilter nft_counter code path are affected. Any distribution or release built before the patch that allows concurrent counter operations is vulnerable. The fix injects a global static spinlock to serialize fetch-and-reset calls, preventing the race. The patch has been applied to the kernel, but affected systems must upgrade to a version containing the commit.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% shows that the likelihood of exploitation is very low. Based on the description, it is inferred that this is a kernel-level race condition that requires local or kernel-privileged access and does not provide a pathway to remote code execution or privilege escalation. The vulnerability is not listed in CISA’s KEV catalog. The primary impact is on the accuracy of firewall counters rather than on system availability.