In the Linux kernel, a recent change removed the commit_mutex lock from the nf_tables reset path, creating a circular lock dependency among commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex. When nft reset, an ipset list operation, and an iptables‑nft rule using '-m set' run at the same time, the three locks can be acquired in conflicting orders, leading to a deadlock. The deadlock stalls the netfilter subsystem, causing nft or iptables commands to hang and potentially leading to a denial of service of network filtering functions.

The vulnerability affects Linux kernel builds that include the commit where commit_mutex was removed from the nf_tables reset routine. These builds are the result of the change introduced by the relevant commits. The affected kernels are therefore those released after the commit that reverts commit_mutex usage. Administrators should check their kernel commit history and verify if their running kernel includes this change. The issue does not apply to older kernel releases prior to this modification.

Based on the description, it is inferred that the exploit requires concurrent execution of nft reset, ipset list, and iptables‑nft commands with '-m set'. The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker with the ability to run these commands—typically a privileged user—could trigger a deadlock that stalls network packet processing, resulting in a denial of service for network traffic. Because the attack hinges on complex concurrency and requires controlled timing, the probability of successful exploitation is considered low, but the impact if achieved is that network filtering functionality could become unresponsive.