A NULL pointer dereference occurs when a netfilter fib expression is evaluated on the netdev egress hook in the Linux kernel. The flaw arises because an egress chain passes validation and then dereferences a null pointer during evaluation, causing a kernel panic and system crash. The vulnerability does not grant code execution or privilege escalation; it only disrupts availability.

All Linux kernel builds that include the vulnerable nft_fib evaluation code. The issue affects every distribution shipping the default kernel with the unpatched netfilter implementation, regardless of vendor.

This defect has a CVSS score of 7.5 and an EPSS score of less than 1%, indicating a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector involves sending crafted packets that activate a fib expression on the egress path, allowing an attacker with network access to repeatedly trigger kernel crashes and force a denial of service. No privilege escalation or remote code execution is possible from this vulnerability, but the resulting system outages can be highly disruptive.