The vulnerability arises from a race condition in the netfilter nft_counter subsystem where concurrent dump and reset operations were performed without proper synchronization. The missing serialization caused different threads to read the same counter values and subtract them twice, resulting in counters being under‑reported. This can produce inaccurate packet accounting for firewall rules and potentially hide malicious traffic or affect traffic‑shaping decisions.

The affected product is the Linux kernel across all distributions and releases that include the netfilter nft_counter code path. Any system running a kernel build prior to the patch that performs concurrent counter operations is vulnerable. The fix is available in kernel versions that incorporate the patch adding a global static spinlock around fetch+reset operations.

Explicit metrics such as CVSS or EPSS are not provided for this CVE. The issue is a local kernel race condition that does not directly enable remote code execution or privilege escalation, but it does corrupt internal counter state. Because it is confined to the kernel, exploitation requires local access and kernel knowledge, and it is not listed in CISA’s KEV catalog. The risk level is considered low to moderate, with the primary concern being data integrity rather than an attacker‑controlled service disruption.