The Linux kernel netfilter nft_inner module contains a flaw where the local lock is released before re‑enabling soft interrupts during an error path. This misordering can cause a use‑after‑free condition, potentially corrupting kernel memory and leading to a crash. The CWE‑821 classification confirms a use‑after‑free vulnerability. The impact includes possible denial of service via kernel panic.

The vulnerability resides in the Linux kernel, specifically the nft_inner code path that handles packet filtering. Any running system using a kernel prior to the patch that contains the vulnerable nft_inner implementation is affected. No explicit kernel version list is provided, so all kernels with the legacy nft_inner implementation may be vulnerable.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of <1 % suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, inferred from the network packet processing nature of nftables, but it requires an error condition to trigger the bug. Prior to patching, an attacker that can trigger the error path might cause a kernel crash. Proper patching is strongly advised.