The vulnerability is a null pointer dereference in the ebt_redirect_tg() function. is removed or moved between its original hook and an NFQUEUE re‑injection, the function receives a NULL pointer from br_port_get_rcu() and dereferences it. This results in a kernel panic, causing an immediate denial of service on the affected system. The flaw originates from an unchecked return value combined with a race condition that userspace can trigger by manipulating bridge ports or moving devices to virtual interfaces such as macvlan.

Linux kernel systems that load the netfilter bridge module. The issue exists in all kernel releases that contain the ebt_redirect_tg() code path and do not yet include the submitted patch. No specific version range is listed, so any kernel that implements the netfilter bridge hook is potentially affected.

The condition requires the ability to control network packets or bridge configuration, typically available to local users with sudo or privileged processes. Once triggered, the kernel panic is guaranteed and provides no authentication bypass or data exfiltration. The CVSS score is not supplied; however, the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, suggesting a low to moderate EPSS. Still, because the impact is complete denial of service with a crash, the risk remains high, especially in environments where bridge netfilter is enabled and manages traffic for critical services.