The Linux kernel’s netfilter flow‑table subsystem contains a race condition related to the order in which tuple nodes are made visible to the garbage collector. The original‑direction tuple node is published first, allowing the garbage collector to free the flow while the offload routine is still inserting the reply node. This ordering can trigger a slab‑use‑after‑free (CWE‑825), which appears as read and write faults in various flowtable functions. If successfully exploited, an attacker could corrupt kernel memory, potentially allowing arbitrary code execution or a kernel crash.

All Linux kernel distributions that ship the vulnerable netfilter flow‑table implementation before the commit that reorders tuple publication are affected. Any kernel lacking the patch is at risk.

The CVSS score of 9.8 indicates a high‑severity kernel use‑after‑free. The EPSS score is below 1  %, implying publicly visible exploitation is currently low. The vulnerability is not listed in CISA KEV, so no active exploits are known. The likely attack vector is local or privileged users who can influence Netfilter flow offloading; based on the race condition, it is inferred that crafted network traffic could also trigger the exploit. Successful exploitation could lead to kernel privilege escalation or a denial‑of‑service through a crash.