A race condition in the Linux kernel’s netfilter nfnetlink_log subsystem allows a user space process to trigger a General Protection fault by timing an UNBIND request against a pending destruction queue. The vulnerability arises because instance unlinking from internal hash tables can occur when reference counts are not yet zero, leading to memory corruption and a kernel crash. This flaw does not directly grant code execution but causes a disruption of kernel operation, effectively denying service for affected nodes.

The flaw is present in all Linux kernel releases that implement the nfnetlink_log module, which is included in most mainstream distributions. The specific kernel version is not listed, but any system running a kernel that has not been patched using the fixes referenced in the kernel commit logs is vulnerable. The affected vendor is Linux, and the product scope is the Linux kernel.

Because the exploit requires crafting specific netlink messages to manipulate the link status, the attack vector is inferred to be local or privileged users with the ability to send netlink packets. The CVSS score is 5.5, indicating a medium severity due to the kernel crash. EPSS is < 1% and the vulnerability is not listed in CISA’s KEV catalog. Attackers who can control netlink traffic or influence socket unbinding may trigger the fault, causing a denial of service that could impact all processes on the affected host.