The vulnerability resides in the Linux kernel’s netfilter x_tables component. It involves the cleanup process executed when an x_tables module is removed with rmmod. The original code detached the filtering table from the packet path and removed it from the active list before fully unlinking its instance and freeing hook operations. As a result, userspace programs that were performing set/getsockopt operations on the table could fail to re‑instantiate the table because its resources had already been released. This inconsistency could leave the system in an unstable state and deny legitimate networking functions. The flaw is a classic example of CWE‑459 – creation.

All Linux kernel distributions that use the legacy x_tables module are potentially affected. No specific version range is listed, so any kernel release prior to the fix that contains the old unlinking logic could be vulnerable. The affected vendor is the Linux kernel itself.

The CVSS score of 7.8 indicates a high probability of a successful exploit that could deny service. The EPSS score of less than 1% suggests that public exploitation is unlikely but the risk remains for targeted, privileged attackers. Based on the description, the likely attack vector is local, as module unloading requires CAP_SYS_MODULE or root privileges. A malicious local user or compromised service with sufficient privileges could trigger buggy cleanup, causing users to lose networking functionality until the system is rebooted or the module is reloaded.