The Linux kernel contains a use‑after‑free bug in the ebtables NFLOG backend. When an ebt_nflog rule is executed, the kernel obtains a logger without holding a reference to the nfnetlink_log module. If that module is unloaded while the rule is still active, the per‑network state that the rule references is freed. Concurrent execution of the logging routine on another CPU then dereferences the freed memory. This produces a use‑after‑free that can crash the kernel or allow an attacker to execute code with kernel privileges. The weakness is identified as a classic use‑after‑free, causing memory corruption.

The flaw exists in the Linux kernel’s netfilter subsystem and affects any system that loads the ebt_nflog module via ebtables. The description does not specify a particular kernel version, so all current and future kernels that include the ebt_nflog code and nfnetlink_log module are potentially impacted until the patch is applied.

Based on the description, it is inferred that an attacker can exploit this vulnerability by unloading the nfnetlink_log module while ebt_nflog rules are still active, causing a use‑after‑free in the kernel's logging path. This exploitation requires privileged access to load or unload kernel modules, so the primary attack vector is local with privilege escalation. The reported EPSS score of less than 1 % indicates a low probability of exploitation, and the CVSS score of 7.8 classifies it as high severity. Because the flaw leads to arbitrary memory corruption and potential kernel crash, the risk is significant for systems that use ebt_nflog and do not protect module unloading. The vulnerability is not listed in CISA’s KEV catalog, but it remains a serious threat to kernel stability.