The vulnerability originates from a race condition in the Linux kernel netfilter flowtable subsystem, where a pending status bit (NF_FLOW_PENDING) is misused to coordinate garbage‑collection (GC) tasks and hardware offload operations. Because the ordering of those tasks was corrupted, GC could run while a flow was still being removed or its statistics were being queried, producing inconsistent or corrupted flow‑table state. This weakness is represented by the CWE identifier CWE‑366 (Race Condition Between Threads). The effect is a potential denial of service or kernel instability caused by corrupted flow‑table data.

All Linux kernel releases that expose the netfilter flowtable component and that have not yet incorporated the commit that generalizes the pending status bit. The exact product name is Linux kernel, and the vulnerability affects all versions before the patch is applied. If a specific version list is not available, all pre‑patch kernels remain at risk.

The CVSS score of 5.9 places the flaw in the medium severity range. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The issue requires local kernel execution, so remote exploitation is unlikely without additional privileges. Likely, the attack vector would involve a local user or attacker with the ability to influence netfilter flow creation, deletion, or statistics retrieval. In that context, the risk is medium to low, with a higher likelihood of impact on systems that perform frequent flow‑table operations or use hardware offload for networking.