A bug in the Linux kernel’s netfilter nft_flow_offload component causes a reference counting error when an initialization function fails, leaving a flowtable reference unreleased. The leak occurs during rule addition; each failed rule silently increases the reference count, preventing the associated flowtable from being removed by nftables and causing persistent resource usage. If unchecked, this resource consumption can grow and eventually prevent new flowtables from being created, potentially disrupting network rule management and underlying services. The vulnerability is a pure resource exhaustion flaw, with no immediate disclosure, exploitation, or elevation of privilege described in the available description.

The flaw resides within the Linux kernel itself and affects all vendor distributions that ship the kernel source unchanged. Both distributions listed under the CNA vendor list identify the kernel product as "Linux:Linux". The specific kernel versions impacted are not enumerated in the supplied data, so any kernel containing the unchecked nft_flow_offload_init path is potentially vulnerable until the referenced commit is applied. Users running any unpatched kernel that supports nft_flow_offload and nftables should confirm whether the fix is present.

The CVSS score is 3.3, indicating a low severity denial‑of‑service impact, and the EPSS score is less than 1%, suggesting a very low probability of exploitation. The vulnerability is a local‑system code change that requires kernel privileges. It is inferred that an attacker who can influence nftables rule creation, such as a local user with sufficient privileges or a compromised service that dynamically manipulates rules, would be able to trigger the error path and cause persistent reference leaks. The KEV catalog does not list this vulnerability, indicating no confirmed exploits. Because the EPSS score is low, precise risk estimation remains limited, but the potential for resource exhaustion persists if the referenced flowtable becomes irrecoverable.