The flaw occurs in the Linux kernel's nf_tables implementation during shift operations. When the source and destination registers overlap, the carry value is derived from the already altered destination, causing the resulting value to be incorrect. This corrupts rule data used by the firewall, potentially leading to unintended packet filtering decisions. The weakness corresponds to CWE‑1335, which involves incorrect handling of operations that have side effects. Based on the description, the likely attack vector is at the packet filtering level where an attacker can craft packets or manipulate nf_tables rules to invoke the faulty shift logic.

All Linux kernels that contain the unpatched nf_tables code are affected. The patch is introduced in commit 18014147d3ee…; therefore any kernel version prior to this commit, regardless of distribution, could be vulnerable. The vulnerability impacts all systems using nf_tables for packet filtering.

The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. The CVSS score of 5.5 suggests moderate severity. Because the bug requires crafted traffic or rules and does not grant privilege escalation or remote code execution, the overall risk remains low to moderate. An attacker would likely need privileged or rule‑manipulation access to exploit the flaw, making operational impact confined to incorrect firewall behavior.