A race condition exists between reference‑count handling in the netfilter ipset subsystem and its garbage‑collection routine. When an ip_set is swapped while a cleanup timer concurrently decrements the set’s reference, the stale pointer can be released, triggering a BUG_ON and a kernel panic. The resulting crash brings the entire system offline, effectively denying service.

The flaw is present in the generic Linux kernel and affects any distribution that ships an unpatched kernel with the legacy ip_set code. No specific version range is listed, so all builds containing the affected netfilter ipset code are vulnerable until the refcount fix is applied.

The CVSS score of 7.8 indicates moderate to high severity, while the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to manipulate ipset entries – typically via privileged ipset commands or applications that use the Netfilter API – and a timing attack that aligns a swap operation with a cleanup timer. A successful race can be triggered by repeatedly issuing ipset swap commands or by inducing rapid entry expirations, eventually causing a kernel panic and service interruption.