The Linux kernel’s nftables subsystem contains a logic flaw in the nft_lookup_eval function. When an inverted set lookup (NFT_LOOKUP_F_INV) encounters a catchall element, the function fails to recompute the match flag after replacing the direct lookup with the catchall, causing packets to be accepted or dropped incorrectly. This violates the integrity of packet filtering decisions, allowing traffic that should be blocked to pass or legitimate traffic to be denied.

This defect exists in the kernel’s nftables module and is present in any Linux kernel build that lacks the fix introduced by the commits 0ab8880, 238c612, e6107a4, and ef0c7d4. Because the change was made upstream, all kernel versions shipped before these patches are potentially affected. Exact affected versions are not listed, so any distribution that has not applied the latest kernel update that contains the fix is at risk.

The CVSS score of 9.1 indicates a high‑severity flaw, while the EPSS score of <1% suggests a very low probability of exploitation in the wild. The vulnerability is not in CISA’s KEV catalog, which implies limited known exploitation. Exploitation requires the ability to modify nftables configuration, a capability that normally necessitates local administrative privileges. If an attacker gains such access, the incorrect verdict could be used to bypass firewall rules, potentially allowing unwanted traffic or blocking legitimate traffic.