The kernel patch limits the use of several iptables extensions—xt_mac, xt_owner, and xt_physdev—to the inet family, preventing them from being applied to non‑IPv4/IPv6 protocols. This change is a corrective measure rather than an introduction of a new vulnerability; it reduces the potential for mis protocol families. The fix thereby stabilizes firewall rule processing without providing a new attack surface such as remote code execution or data exfiltration.

All Linux kernel deployments are impacted because the change is applied globally in the kernel source tree. The patched code applies to all Linux distributions that ship the updated kernel; no specific vendor or version is listed, so any system running a newer kernel receiving this commit will include the restriction.

The CVSS score is 5.5, indicating a moderate level of security impact. The EPSS score is < 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, further indicating lower exploitation likelihood. The likely attack vector is through misuse of iptables rules that reference the affected extensions with a protocol other than IPv4 or IPv6, but this is considered a misconfiguration rather than an exploitable flaw. As a result, the overall risk remains low, and monitoring for rule compatibility is sufficient.