A race condition exists between reference‑count handling in the netfilter ipset subsystem and its garbage‑collection routine. When an ip_set is swapped while a cleanup timer concurrently decrements the set’s reference, the stale pointer can be released, triggering a BUG_ON and a kernel panic. The resulting crash brings the entire system offline, effectively denying service.

The flaw is present in the generic Linux kernel and affects any distribution that ships an unpatched kernel with the legacy ip_set code. No specific version range is listed, so all builds containing the affected netfilter ipset code are vulnerable until the refcount fix is applied.

The CVSS score of 7.8 indicates moderate to high severity, and the EPSS score is below 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker who can reach privileged ipset commands or use applications that invoke the Netfilter API, and who can time a swap operation with a cleanup timer to trigger the race. Exploitation would therefore rely on repeatedly issuing ipset swap commands or inducing rapid entry expirations, eventually causing a kernel panic and service interruption.