The Linux kernel’s ebtables module contains a race condition where the table operations structure was assigned while the ebt mutex was not held. This allowed a partially initialized table to be visible to other kernel paths, potentially resulting in wrong packet filtering, improper cleanup, or a use‑after‑free condition. The weakness aligns with CWE‑362 for race conditions and CWE‑413 for improper cleanup or use‑after‑free errors.

All Linux kernel releases that include the ebtables module are affected; the vulnerability description does not specify version ranges, so any kernel variant shipping with ebtables should be examined for the presence of the race condition and updated once the two‑stage removal scheme is implemented by the kernel maintainers.

The CVSS score of 7.8 places this flaw in the high‑severity range, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local privileged process that can trigger the removal race, for example by rapidly adding and deleting ebtables entries. Such exploitation could lead to incorrect packet filtering or potentially a denial‑of‑service, and in some configurations might provide a foothold for privilege escalation or lateral movement within the host; however, no remote code execution vector is explicitly documented. The overall risk remains high due to the severity of the flaw, but the practical exploitation probability is low at this time.