A NULL pointer dereference occurs when a netfilter fib expression is evaluated on the netdev egress hook. The implementation incorrectly allows the egress chain to pass validation and then dereferences a null pointer during evaluation, causing a kernel panic. This results in a complete loss of service for the affected system and requires a reboot to restore functionality.

Any Linux kernel build that includes the vulnerable nft_fib evaluation code. The issue affects all vendors that ship the default distribution kernel without the fix, as the vulnerability is present in the core netfilter implementation, not specific to a particular distribution.

The flaw can be triggered by sending a crafted packet that activates the fib expression on the egress path. An attacker with network access and the ability to direct traffic through the target device can repeatedly cause kernel crashes, forcing a DoS. The vulnerability does not provide code execution or privilege escalation; it only disrupts availability. No EPSS score is available, and the vulnerability is not yet listed in the CISA KEV catalog. The high impact is due to the kernel crash core to all services running on the host.