A kernel bug in tc_ctl_chain() processes repeated RTM_GETCHAIN netlink requests without discarding them, enabling a CPU‑hungry loop that results in hung tasks and a denial of service. The oversight can trigger a Hung Task splat by repeatedly allocating and releasing skb structures, effectively exhausting processor time and destabilising the system. The problem is resolved in recent commits that apply replay logic only to RTM_NEWCHAIN requests.

The flaw affects the Linux kernel in all releases prior to the patch that removes the replay for RTM_GETCHAIN. Vendors that ship kernels without the fix remain vulnerable until an updated kernel is deployed.

Exploitability requires the ability to generate repeated RTM_GETCHAIN netlink messages. Based on the description, it is inferred that this capability typically requires privileges similar to those of local users or processes with appropriate rights. The CVSS score of 5.5 indicates medium severity, and the weakness involves CWE-835 (Infinite Loop). The EPSS score of 0.00168 and the fact that the vulnerability is not listed in CISA KEV suggest that the likelihood of exploitation is low, but the potential to cause CPU exhaustion and hung tasks presents a moderate to high denial‑of‑service risk. Based on the description, it is inferred that the lack of network‑bound vectors means local compromise is necessary, and once achieved, an attacker can trigger a system‑wide performance degrade with repeated requests.