The vulnerability involves an imbalance in the decrementing of recursion counters used by the nf_dup_netdev module of the Linux kernel. When packets are transmitted across multiple CPU cores, the counters controlling packet recursion are not properly decremented, which can lead to a corrupted stack state or infinite recursion. Based on the description, this flaw could potentially cause kernel instability or a denial‑of‑service condition, though such an outcome is inferred rather than explicitly stated in the official report.

The flaw affects any Linux kernel that incorporates the nf_dup_netdev module without the nf_dev_xmit_recursion helpers added in the referenced patch. This includes mainline kernels predating commit 2354e9759 as well as kernel versions in distributions that have not incorporated that commit. All Linux platforms running an affected kernel should consider this issue patchable via a kernel update.

The CVSS score of 7.8 indicates high severity, while an EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is known. The description does not specify privilege requirements; however, the flaw resides in the network packet handling path of the kernel, so it is likely exploitable through crafted network traffic sent to the affected host. Attackers would need to target packets traversing the nf_dup_netdev code to trigger the recursion counter imbalance.