During a resize of an ipset table, the kernel copies comment pointers with memcpy instead of duplicating the comment objects, creating a window where the old table is still published while the new table contains a stale pointer to shared comment data. If a packet‑side ipset add hits the old entry in this window, the add routine frees the shared comment through the old entry, leaving the new table with a dangling pointer; a subsequent replay of the queued add then dereferences that stale pointer, corrupting kernel memory. The flaw represents a race condition and a use‑after‑free, allowing a local attacker to trigger a kernel panic or potentially execute code with elevated privileges.

All Linux kernel builds that ship the netfilter ipset module prior to the commit that fixes the comment‑pointer handling are affected. The vulnerability applies to any kernel where the ipset module does not include the fix, including both upstream kernels and vendor‑patched distributions that have not yet applied the update.

The CVSS base score of 8.4 classifies the issue as high severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires precise timing between a table resize operation and a concurrent packet‑side add, making it a difficult‑to‑reproduce race condition, but once achieved it could cause a kernel crash or privilege escalation to root on the affected host.