The vulnerability originates from a race condition in the Netfilter x_tables module, where a table is added to the per‑NetNS list before its hook operations are fully allocated. If a per‑NetNS exit occurs at the same time, the cleanup code can find the table with a NULL ops pointer and pass it to nf_unregister_net_hooks, which dereferences the NULL pointer and triggers a general protection fault. The fault causes the kernel to panic, resulting in an immediate loss of service on the affected node.

Linux kernel builds that include the Netfilter x_tables component are affected. The fix is included in upstream commits referenced above; systems running kernel versions that predate those commits should upgrade to a kernel containing the patch.

The CVSS score is 5.5 and the EPSS is less than 1%, indicating a moderate severity with a low likelihood of exploitation under ordinary circumstances. The vulnerability is not listed in the CISA KEV catalog. The crash occurs only when the kernel is asked to tear down a NetNS that contains a table with incomplete hook operations, so exploitation would require an attacker with local privileged access to load a malicious table or otherwise trigger the race condition. This inference is based on how the vulnerability is triggered in the kernel code.