A concurrency bug in the Linux kernel’s nfnetlink_queue subsystem allows a thread that closes a netlink socket to trigger the release function while another thread processes an UNBIND request for the same port identifier. This race condition causes a general protection fault in the nfnetlink_queue module, leading to a kernel panic and denial of service on the affected host.

The flaw resides in the Linux kernel’s netfilter nfnetlink_queue implementation. Any kernel build that includes this subsystem is potentially vulnerable; specific affected kernel versions are not listed in the advisory.

The vulnerability is triggered by concurrent netlink operations and likely requires a privileged user to create the offending socket interactions, though this requirement is inferred from the need to open and close privileged netlink descriptors. The CVSS score of 5.5 indicates moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploitation record exists. The impact of a kernel crash represents a critical failure mode, so the risk is moderate until an exploit is discovered, but the severity of a kernel DoS warrants prompt action.