In the Linux kernel’s netfilter subsystem, the xt_hashlimit module was found to inadequately validate the XT_HASHLIMIT_RATE_MATCH flag mode. When this mode is enabled by multiple rules that reference the same hashtable entry, the code can read the burst field from an uninitialized union member, exposing sensitive kernel data. This weakness is a CWE-457 uninitialized variable issue and may lead to CWE-200 information disclosure, allowing an attacker to gain read access to kernel memory and potentially facilitate further exploitation.

This vulnerability targets the Linux kernel, affecting all releases that include the xt_hashlimit chain rule processing code. No specific version range is listed in the advisories; therefore, any Linux kernel incorporating this component prior to the patch should be considered vulnerable.

Based on the description, it is inferred that the vulnerability requires an attacker to have the capability to insert or modify iptables rules that reference the same hashtable with the XT_HASHLIMIT_RATE_MATCH flag. When two or more such rules are present, the kernel may read the burst field from an uninitialized union member, potentially leaking kernel memory contents. The defect does not provide a direct remote code execution path, and an exploit would likely be restricted to privileged local users or system components that manage netfilter. The CVSS score of 7.1 indicates high severity, and with an EPSS score of < 1% and no listing in the CISA KEV catalog, the likelihood of exploitation remains uncertain, but the potential impact on confidentiality warrants timely remediation.