A high-severity vulnerability in the Linux kernel netfilter component could allow a local authenticated attacker to bypass namespace isolation, leading to potential privilege escalation.

The nft_object rhltable is incorrectly implemented as a global structure rather than being scoped to the network namespace. This allows an attacker with low-level local access to interact with objects being removed in other network namespaces.

This flaw can be leveraged to achieve unauthorized access or escalate privileges by manipulating network filter objects across namespaces. A CVSS score of 7.8 underscores the necessity of addressing this issue to prevent cross-container or cross-user compromise.

Immediate Action: Update the Linux kernel to version 6.12.103, 6.18.44, 7.1.8, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor for unusual netfilter configuration changes or unexpected errors in containerized environments.

Compensating Controls: Implement strict container security policies and resource limits to contain the impact of potential local exploitation.

Public Exploit Available: No

This vulnerability poses a significant risk to multi-tenant and containerized Linux environments. Administrators should deploy the necessary kernel patches immediately to ensure network namespace isolation and prevent unauthorized cross-namespace object manipulation.