A race condition exists in the Linux kernel’s netfilter SYNPROXY hook registration when multiple users concurrently add iptables targets or nftables expressions. The conflict corrupts reference counts, which can lead to a kernel crash and thus a denial‑of‑service. This flaw corresponds to improper synchronization of access to reference counts (CWE‑820).

All Linux kernels that do not contain the mutex patch introduced by the recent commit are affected, including the release candidate versions of 7.1 and earlier releases. Any distribution kernel that has not incorporated the synchronization commit is vulnerable, regardless of its specific vendor or distribution.

The CVSS score is 5.5 and the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. The likely attack vector is a privileged local attacker or a process with firewall‑configuration rights that can trigger concurrent SYNPROXY rule additions. Remote exploitation without such local privileges is unlikely; however, the potential for a kernel crash makes the risk moderate to high for environments that enable concurrent configuration changes. Based on the version information and description, it is inferred that earlier kernel releases lacking the mutex patch are affected, but this inference is not explicitly stated in the CVE data.