The kernel’s netfilter ipset module previously performed a free operation before reassigning a pointer, which could leave a reference to freed memory. This ordering error creates a use‑after‑free that can corrupt kernel memory and may enable arbitrary code execution with elevated privileges.

All Linux kernel builds that contain the netfilter ipset feature and that have not yet incorporated the commit that reorders the calls are affected. The code path exists in every kernel release prior to the commit represented by the hash 3ca9982a8882470aa0ac4e8bb9a552b181d1efcd. Administrators should verify whether their running kernel includes this commit or upgrade to a kernel version that integrates the patch.

The EPSS score is below 1%, indicating a low probability of exploitation in the wild. The CVSS score of 7.8 reflects a high severity risk. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to send malicious network traffic that triggers the ipset comment extension processing path. The likely attack vector is network‑based via crafted packets, potentially leading to a kernel crash or arbitrary code execution.