The vulnerability stems from improper handling of hook removal in the nf_tables subsystem. During device deletion, hooks are moved from the basechain/flowtable hook_list to a transaction hook_list without preserving the NFT_HOOK_REMOVE flag, so the RCU‑protected list is corrupted. Utilities that walk this list via netlink, such as nft or generic netlink dump commands, will crash or return incomplete data. Consequently, any user or application that enumerates nf_tables hooks could be denied service. The weakness involves a memory‑consistency race (CWE‑362) and an RCU protection violation (CWE‑821).

All Linux kernel versions prior to the inclusion of the two commits that restore the NFT_HOOK_REMOVE flag and correct hook transaction handling. This includes every distribution that ships a vanilla kernel without these patches. The vulnerability is independent of distribution version because it resides in the core kernel nf_tables subsystem.

The CVSS score of 7.8 indicates a high‑impact local flaw. The EPSS score is less than 1 %, reflecting a very low probability of spontaneous exploitation. The vulnerability is not listed in the CISA KEV catalog. It is inferred that an attacker must have local privileged access, such as the ability to load kernel modules or invoke netlink commands, to manipulate nf_tables hooks. No remote interface is exposed. The flaw permits a denial‑of‑service condition by crashing or corrupting netlink dump utilities that enumerate nf_tables hooks, but it does not grant further compromise. The concurrency race (CWE‑362) could be leveraged during concurrent hook removal to accelerate corruption, though the practical impact remains limited to local denial of service.