The nf_flow_table module in the Linux kernel overwrites an already referenced destination entry when skb_dst_set_noref() is invoked on a socket buffer that still holds a reference. This mismanagement corrupts the reference count of the destination entry, triggering a DEBUG_NET_WARN_ON_ONCE assertion inside skb_dst_check_unset(). If the stale reference is subsequently accessed, it could lead to kernel instability or a crash, but the advisory itself does not explicitly confirm a crash. The flaw represents a reference‑counting error (CWE‑911) and can be exploited by manipulating packet processing in the nf_flow_table or XFRM offload paths.

All Linux kernel builds that enable the nf_flow_table or XFRM offloading features are susceptible. The advisory does not provide version exclusions, so any machine running a kernel that includes these modules—regardless of distribution or patch level—is potentially affected.

The CVSS score of 7.5 indicates moderate severity, and the EPSS score is reported as <1%, suggesting a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known public exploits. Attacks would likely involve sending crafted network traffic to trigger the nf_flow_table or XFRM offload hooks, inferred from the advisory description. The DEBUG_NET_WARN_ON_ONCE assertion could result in kernel instability, but no confirmed crashes are documented.