In Linux kernels that include the nf_tables subsystem, a flaw in the handling of hook removal records misdirects hooks that are being deleted into a transaction list while simultaneously dismantling the RCU‑protected hook list. That corruption causes diagnostic utilities such as netlink dump and nft command parsing to crash or produce incomplete data, resulting in a denial‑of‑service condition for any process that enumerates nf_tables hooks. The weakness is a memory‑consistency issue identified as CWE‑821.

All Linux kernels that incorporate the nf_tables subsystem prior to the incorporation of the patches identified by commits 10f79dbd and 4e69bfb3. Any distribution running an unpatched kernel that enables device removal or dynamic hook manipulation for nf_tables is vulnerable. The issue is tied to the core kernel and not confined to a specific distribution version.

The CVSS score of 7.8 indicates a high‑impact local flaw. The EPSS score is less than 1 %, demonstrating a very low likelihood of spontaneous exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must have local privileged access or the ability to load a kernel module to modify netfilter hooks via netlink; no remote interface is exposed. Thus the primary attack vector is local privileged manipulation of nf_tables configuration, leading to kernel‑level denial of service.