A vulnerability in the Linux kernel netfilter subsystem allows a local attacker to cause memory or state inconsistencies, potentially leading to system instability or security policy bypass.

The vulnerability resides in the netfilter nf_tables component, where improper sequencing of hardware offload steps relative to chain blob allocation creates a race condition. An attacker with local, low-privileged access can trigger this state inconsistency to corrupt or bypass network filtering rules.

Successful exploitation of this flaw can result in the subversion of network security policies, as the kernel may enter an inconsistent state where hardware and software rulesets diverge. This effectively allows an attacker to bypass firewalls or traffic control mechanisms, potentially leading to unauthorized data access or complete system disruption. Given the CVSS score of 7.1, this is considered a high-risk vulnerability for environments relying on kernel-based packet filtering for network security.

Immediate Action: Update the Linux kernel to the corrected versions (5.10.270, 5.15.221, 6.1.188, 6.6.157 or later) provided by your distribution maintainer.

Proactive Monitoring: Monitor system logs for kernel-related crashes or unexpected netfilter performance degradation that may indicate an attempt to exploit the inconsistency.

Compensating Controls: Restrict local access to the system to trusted users only, as the attack vector requires local, authenticated access to the kernel environment.

Public Exploit Available: No

Security teams should prioritize updating the Linux kernel across all affected environments to the specified fixed versions. As this vulnerability affects the core network filtering stack, failing to patch may leave systems vulnerable to local privilege escalation or security policy circumvention. Ensure that kernel updates are validated in a staging environment to maintain system stability before broad deployment.