The netfilter ipset subsystem in the Linux kernel contains a race condition that arises when an IP set is destroyed. The code cancels scheduled garbage‑collector work but subsequently posts new work without verifying that it has been cancelled, which can leave the garbage collector running after the set has been released. This improper shutdown can cause kernel instability or a crash, resulting in a denial‑of‑service to the affected system.

All Linux kernel releases prior to incorporating commit 12088da6 in the netfilter ipset code are affected. Kernels that include this commit or later versions contain the fix and are no longer vulnerable. The vulnerability applies to all mainstream distributions based on those kernel versions unless they have applied this patch separately.

The EPSS score of < 1 % indicates that the likelihood of exploitation is very low. The CVSS score of 7.8 reflects a high severity adverse impact. The flaw is not listed in the CISA KEV catalog and no public exploits have been reported. Exploitation would require an attacker to perform privileged ipset operations, which typically needs root or administrative access. Based on the description, this prerequisite is inferred rather than explicitly stated. If ipset commands are exposed to untrusted users or processes, the risk would increase; otherwise the threat remains limited to trusted administrators but still poses a risk due to the potential kernel crash.