The vulnerability occurs when the netfilter flow offload worker sets the flag indicating that a flow has been processed by hardware before it clears the pending status flag. If the worker is preempted during this window, the RCU callback may free the associated flow object while the worker still holds a reference, resulting in a use-after‑free.

This flaw affects the Linux kernel’s netfilter flowtable implementation. All distribution kernels that ship the current flow offload code path are vulnerable; no specific version range is listed in the advisory, so any kernel version prior to the published commit that implements the described logic is at risk.

The CVSS score of 4.7 places the flaw in the moderate severity range. The EPSS score of <1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV catalog. The description indicates a race condition in the netfilter flow offload worker that could expose a use‑after‑free if the worker is preempted between flag settings, but no further details on exploitation mechanisms are provided.