A race condition exists in the Linux kernel’s netfilter ipset subsystem where the RCU lock is incorrectly released while a hash table it protects may still be in use. This flaw permits a concurrent reader to access freed or partially updated data, potentially causing a kernel memory corruption or crash whenever the affected reference counter is modified.

Every Linux kernel that includes the netfilter ipset module is vulnerable, regardless of distribution. The issue is present in upstream kernels and affects any stock kernel that has not incorporated the upstream patch; no specific version range is listed, so any kernel containing the ipset code before the fix is at risk.

The severity score of 7.8 indicates high impact, but the EPSS score of less than 1 % shows a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, implying no widespread attacks are known. The likely attack vector is network‑based traffic that triggers concurrent ipset updates or lookups, requiring precise timing to exploit the race. While the theoretical impact is severe, the practical risk remains modest due to the difficulty of reliably triggering the condition.