The vulnerability occurs when the Linux kernel performs 64‑bit per‑CPU statistics updates after local interrupts have been re‑enabled. On 32‑bit processors the update routine disables only preemption, not interrupts. When a nested interrupt occurs on the same CPU during the update, the reentrant sequence count can be corrupted, altering statistical counters that the kernel uses for diagnostics or accounting. The compromised data can lead to incorrect resource accounting or misleading telemetry, potentially affecting system monitoring or decision‑making that relies on these counters.

All Linux kernel configurations that include the net_dm packet trace, drop monitor, or hardware trap packet probe hooks are affected when the code paths remain enabled. The specific kernel version numbers are not listed in the data therefore any kernel release that has not applied the upstream fix for this drop monitoring issue is potentially vulnerable. The vulnerability is relevant to 32‑bit architectures where the kernel uses u64_stats_update_begin() for per‑CPU statistics tracking.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score of < 1% reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no known public exploits are reported. It is inferred that an attacker would likely need local access with sufficient privileges to activate the packet tracing hooks or otherwise trigger the vulnerable code paths, so the attack vector is effectively local. Given the low exploitation probability and lack of documented attacks, the overall risk is low to moderate.