A kernel bug in tc_ctl_chain() processes repeated RTM_GETCHAIN netlink requests without discarding them, enabling a CPU‑hungry loop that results in hung tasks and a denial of service. The oversight can trigger a Hung Task splat by repeatedly allocating and releasing skb structures, effectively exhausting processor time and destabilising the system. The problem is resolved in recent commits that apply replay logic only to RTM_NEWCHAIN requests.

The flaw affects the Linux kernel in all releases prior to the patch that removes the replay for RTM_GETCHAIN. Vendors that ship kernels without the fix remain vulnerable until an updated kernel is deployed.

Exploitability requires the ability to generate repeated RTM_GETCHAIN netlink messages, which is typically available to privileged local users or processes with appropriate rights. While the EPSS score is not available and the vulnerability is not listed in CISA KEV, the potential to cause CPU exhaustion and hung tasks presents a moderate to high denial‑of‑service risk. The lack of network‑bound vectors suggests that local compromise is necessary, but once achieved, the attacker can trigger a system‑wide performance degrade with repeated requests.