The vulnerability stems from a race condition in the netfilter nft_counter subsystem where simultaneous dump and reset operations occur without proper synchronization. Without serialization, two parallel resets can each read the same counter totals and subtract them twice, causing the counters to fall below the true values. The consequence is misleading firewall accounting, which can hide malicious traffic or lead to incorrect traffic‑shaping decisions, thereby compromising data integrity for network administrators.

All systems running the Linux kernel that include the netfilter nft_counter code path are affected. Any distribution or release with a kernel build before the patch that allows concurrent counter operations is vulnerable. The fix is implemented in the kernel via a global static spinlock that serializes fetch‑and‑reset calls.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% shows that the likelihood of exploitation is very low. Since the flaw is a kernel‑level race condition, it requires local or kernel‑privileged access and does not provide a pathway to remote code execution or privilege escalation. The vulnerability is not listed in CISA’s KEV catalog, and the primary impact is on the accuracy of firewall counters rather than on system availability.