A flaw in the Linux kernel's nf_tables handling causes expired catchall elements to persist until the garbage‑collection interval expires. These stale entries are invisible to userspace dumps, yet they block the re‑insertion of identical rules and cause delete operations to silently fail. As a result, a set of rules can silently stop matching, leading to misconfiguration of network filtering and, in some circumstances, a loss of connectivity for affected services.

All Linux kernel builds that implement the nf_tables framework and have not incorporated the commit that fixes this issue are vulnerable. The available data lists the vendor as "Linux" with no specific version range, so any kernel that includes nf_tables prior to the resolution is potentially affected.

The CVSS score of 3.4 indicates limited severity, and the EPSS score is below 1 %, with the vulnerability not listed in the CISA KEV catalog. The likely attack vector requires local kernel privilege to alter nf_tables rules, which is inferred from the need to insert or delete rules. When exploited, the impact is primarily on the availability of network services that rely on the affected rule set.