The vulnerability arises from unsynchronised notification queuing in Linux netfilter’s nf_tables subsystem. When a packet route invokes nft_obj_notify() while a netlink transaction is in progress, the code performs an unprotected list_add_tail() that races with a list_del() and subsequent kfree_skb() executed under commit_mutex. This race can write to a freed sk_buff, resulting in a slab-use‑after‑free crash reported by KASAN. The kernel memory corruption can lead to a kernel panic or potentially allow a local attacker to execute arbitrary code with kernel privileges.

Affected systems are Linux kernel releases before the fix is applied, notably kernel 7.2‐rc6 and earlier snapshots showing the same notification logic. All Linux installations that load the nf_tables module and evaluate nf_quota rules on packet paths are susceptible until the patch is merged.

The bug is a high‑severity kernel memory corruption flaw. While the EPSS score is not available and the vulnerability is not listed in CISA KEV, its CVSS is not disclosed here, the intrinsic nature of a kernel use‑after‑free suggests a high exploitability for a local attacker who can send crafted packets to trigger the race. The likely attack vector is local, requiring the attacker to inject packets that invoke nf_quota evaluation while a netlink transaction is dispatched. Successful exploitation would cause a denial of service or elevate privileges to kernel level.