In the Linux kernel’s netfilter x_tables module a function intended to clean up when the module is removed was replaced with a second-stage routine. The original code detached the table from the packet-path and removed it from the active list during rmmod. After the change, userspace that still has open set/getsockopt handles on that table can no longer re-instantiate it because the table has already been removed from the per-network-namespace list and its hooks freed. This mismatch causes network processing to fail for any traffic that would normally be handled by the missing table, effectively denying legitimate network operations. The weakness is a flaw in the handling of the module unload sequence and is characterized as CWE-459.

All Linux kernels that include the legacy x_tables/xtables branch and are running a version before the fix are affected. The commit that added xtables_unregister_table_exit is present in the 7.1 release candidates rc1 through rc3 and is expected to appear in the stable 7.1 release and subsequent kernels. Any system that compiles and loads the x_tables module - whether it is the default netfilter configuration or a user-configured module - shall be considered vulnerable until the kernel is updated to a version that contains this change.

The CVSS score of 7.8 indicates high severity, but the EPSS score of < 1 % indicates that public exploitation is currently unlikely. The flaw is only exploitable by a local attacker who has the ability to unload a kernel module, which typically requires CAP_SYS_MODULE privilege or root access. An attacker who gains such privileges could trigger a denial of service by unloading the affected module while a userspace program engages in set/getsockopt on it, leading to loss of network connectivity until the module is reloaded or the system is rebooted. The issue is not listed in the CISA KEV catalog, so no known publicly released exploit is available at this time.