The Linux kernel’s nftables nft_inner module releases the local lock before re‑enabling soft network interrupts during an error path, incorrectly ordering lock acquisition and release. This misordering can leave the kernel in an inconsistent state, potentially leading to a system crash or denial of service. The problem is a classic lock‑ordering violation that violates correct concurrency discipline.

All Linux kernel releases that contain the vulnerable nft_inner implementation are affected. The known CPE list includes the generic linux kernel as well as the 7.1 release candidates (rc1 through rc4). Any kernel built from source that has not incorporated the patch correcting the lock ordering is vulnerable.

The CVSS score of 9.8 marks the flaw as critical. The EPSS score of <1 % indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, inferred from nftables’ role in processing network packets, but the flaw requires an error condition to be triggered, which suggests a more complex exploitation path.