The vulnerability occurs when the netfilter flow offload worker sets the flag indicating that a flow has been processed by hardware (NF_FLOW_HW_DEAD) before it clears the pending status flag (NF_FLOW_HW_PENDING). If the worker is preempted after publishing NF_FLOW_HW_DEAD, the RCU callback may free the associated flow object while the worker still holds a reference. This race condition results in a use‑after‑free that can corrupt memory or execute arbitrary code after the worker resumes.

This flaw affects the Linux kernel’s netfilter flowtable implementation. All distribution kernels that ship the current flow offload code path are vulnerable; no specific version range is listed in the advisory, so any kernel prior to the published commit that implements the described logic is at risk.

Based on the description, it is inferred that exploitation would likely require local privilege or careful crafting of network traffic to trigger an offloaded flow that is freed prematurely, and the lack of an RCU lock increases the potential impact. The CVSS score is not supplied, but the presence of a use‑after‑free indicates a high severity risk. EPSS is unavailable and the vulnerability is not currently listed in CISA’s KEV catalog.