This vulnerability arises in the Linux kernel’s netfilter nft_compat layer, where ebtables emulation mistakenly permits non‑bridge targets to be accepted. The result is that firewall rules can incorrectly allow traffic that should be blocked, effectively bypassing ebtables’ filtering logic. The underlying weakness is improper validation of target types, a common input‑validation or access‑control failure. Consequently, an attacker could manipulate network traffic to gain unauthorized connectivity or evade filters, depending on the context of the rule set.

The affected product is the Linux kernel. No specific kernel versions are listed in the CNA data, so any kernel build that includes the nft_compat layer without the latest ebtables target rejection patch is potentially vulnerable. Administrators should verify the kernel version against vendor release notes for the commit that introduced the fix.

The CVSS and EPSS metrics are not publicly available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation is known. The likely attack vector involves a local user with rights to add or modify netfilter rules; an attacker could craft a rule that utilizes a non‑bridge target, causing the kernel to incorrectly apply a drop or accept verdict. Because the flaw resides in kernel‑space logic, exploitation would require local or privileged access, but in multi‑tenant or high‑privilege scenarios this could lead to widespread network bypass.