The kernel patch limits the use of several iptables extensions—xt_mac, xt_owner, and xt_physdev—to the inet family, preventing them from being applied to non‑IPv4/IPv6 protocols. This change is a corrective measure rather than an introduction of a new vulnerability; it reduces the potential for mis protocol families. The fix thereby stabilizes firewall rule processing without providing a new attack surface such as remote code execution or data exfiltration.

All Linux kernel deployments are impacted because the change is applied globally in the kernel source tree. The patched code applies to all Linux distributions that ship the updated kernel; no specific vendor or version is listed, so any system running a newer kernel receiving this commit will include the restriction.

No CVSS score is published and the EPSS metric is not available, indicating the vulnerability is not currently targeted or exploited. The patch is also not listed in CISA KEV, further suggesting a low likelihood of exploitation. The likely attack vector is through misuse of iptables rules that reference the affected extensions with a protocol other than IPv4 or IPv6, but this is considered a misconfiguration rather than an exploitable flaw. As a result, the overall risk remains low, and monitoring for rule compatibility is sufficient.