The nfnetlink logging subsystem releases per‑network state while RCU readers may still be in progress, because the logger pointer is cleared without waiting for an RCU grace period. This race condition can trigger a use‑after‑free that may lead to memory corruption or a denial‑of‑service crash. The issue originates from the nfnetlink_log implementation and applies to all kernel code that handles packet logging through nf_log_packet.

All Linux kernel versions that contain the nfnetlink_log code prior to the patch adding the RCU grace period are potentially affected. No specific kernel releases are enumerated in the advisory, so any distribution running a kernel that has not applied the commit series referenced in the advisory is at risk.

The CVSS score is 7.8 and the EPSS score is below 1%, indicating a low probability of exploitation in practice. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local or privileged context to trigger the race, such as loading or unloading the nfnetlink_log module while packets are being logged. Once the race is achieved, the outcome ranges from a crash to arbitrary memory corruption, so the risk is significant for systems that rely on nfnetlink logging while the flaw remains present.