In the Linux kernel, the function nft_payload_offload_mask constructs a filter mask for payload expressions that cover only part of a header field. A bug in the mask construction uses an undefined 32‑bit shift when handling partial IPv6 address matches, causing the mask to include more bytes than intended. This mis‑construction may cause netfilter to misclassify or drop packets that should be accepted—or, conversely, allow malformed packets to bypass expected rules, potentially leading to a denial of service in the packet‑processing path. This flaw aligns with CWE-1335.

Linux kernel builds that include the unpatched nft_payload_offload_mask function are affected. The issue was fixed in the referenced kernel commits; any distribution that has not yet incorporated those changes remains vulnerable. If a system is running a kernel version older than the commit dates, it must be updated to a version that includes the patch.

The EPSS score of < 1% indicates a very low probability of exploitation, and the CVE is not listed in CISA KEV, suggesting limited known exploitation. Exploitation would require an attacker to inject crafted packets into the kernel packet‑processing path. The CVE description does not mention an explicit access requirement, so it is unclear whether local or privileged access is necessary. This statement is inferred from the description and not directly stated in the CVE record. The flaw does not provide direct code‑execution; rather, it can be used to subvert packet filtering or cause a denial of service. The CVSS score of 7.1 indicates a high severity.