The bug occurs when Netfilter flow table entries are published in an order that allows the garbage collector to observe a partially initialized flow. This race results in a slab use‑after‑free, which KASAN detects as read and write errors in various flow table routines. The fault can corrupt kernel memory and could allow an attacker to trigger a kernel crash or execute arbitrary code with kernel privileges.

All Linux kernel distributions that ship the Netfilter flow table subsystem prior to the commit that reorders tuple publishing are affected. No specific version numbers are listed, so any kernel lacking the patch is at risk. The vulnerability is inherent to the Linux kernel, affecting all vendors that use it.

The CVSS score is not publicly available, and the EPSS score is unknown. The vulnerability is a classic use‑after‑free race, historically considered high‑risk for kernel privilege escalation. Because the flaw requires a race between flow table insertion and garbage collection, successful exploitation likely needs local privileges or the ability to influence Netfilter flow offloading. The vulnerability is not yet listed in the CISA KEV catalog.