The nf_tables subsystem in the Linux kernel unregistered hooks without using the proper RCU deletion routine, list_del_rcu. When a hook is removed, the list element can still be traversed by concurrent dumpers, allowing the element to be freed while it is being read. This can result in a null pointer dereference or memory corruption that may crash the kernel or cause a kernel panic. The weakness lies in improper synchronization of a shared data structure that is accessed concurrently.

Any Linux kernel that contains the nf_tables code and has not applied the patch that introduces list_del_rcu in nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks may be vulnerable. No specific version range is listed, so all kernel releases before the application of this fix have the potential to be affected, including distribution builds that have not applied the corresponding update.

The CVSS score of 7.0 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to trigger a race between a hook unregistration and a concurrent list traversal. While a remote exploit is not documented, the possibility of kernel instability and potential denial of service makes this a high‑risk problem for affected systems.