In the Linux kernel the nf_log syslog and nfnetlink_log subsystems register per‑network‑namespace loggers. During module teardown the global logger is unregistered after the per‑net cleanup, creating a race window where a new logger can be bound while the stale per‑net reference remains. If a sysctl or netlink writer then uses that stale pointer a null dereference or use‑after‑free can occur, causing a kernel panic and bringing the system down. This flaw is a concurrency race (CWE‑825) that produces a denial‑of‑service condition by crashing the kernel.

All Linux kernel installations that include the nf_log syslog or nfnetlink_log modules are affected. The CNAs identify the vendor as Linux:Linux and the CPE indicates the Linux kernel broadly. No specific kernel version is listed; any kernel lacking the ordering fix described in the patch is vulnerable.

The CVSS score is 7, which reflects high severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The flaw is not listed in CISA KEV. The attack requires triggering the unregister sequence followed by a writer that rebinds the logger; the description references sysctl or netlink writers, which typically need privileged access, so it is inferred that root or a privileged user must initiate the race. No public exploit is known, but if such a privilege is obtained, a single kernel crash can compromise availability.