In Linux kernels, the netfilter x_tables get‑entries routine incorrectly copies a per‑CPU counter pointer from the kernel to a user buffer before the pointer is sanitized. On SMP systems a, and the kernel then returns –EFAULT while the This allows an attacker to obtain a kernel memory address, constituting a data‑exposure vulnerability (CWE‑200).

All Linux kernel installations that have the unpatched x_tables get‑entries paths before commit 08a3e218064db11f154ad9ad5541751ea7f34ebe are affected. The patch was integrated into the mainline kernel in that commit, so any kernel newer than that is considered non‑vulnerable.

The vulnerability is a local kernel issue; exploitation requires a process with the ability to invoke the get‑entries system call. The likely attack vector is a local attacker triggering the path and observing the leaked pointer. The EPSS score is not available, the vendor has not listed the issue in CISA KEV, and the CVSS rating is not disclosed. Nevertheless, the data‑exposure creates a high risk of facilitating privilege‑escalation if the attacker can combine the leaked address with additional kernel exploitation techniques. This assessment is inferred from the nature of the pointer leak and standard exploitation practices.