Linux Kernel EUVD-2026-32367

The Linux kernel netfilter subsystem uses nf_tables as its primary packet classification and filtering framework. Correct kernel locking requires that all lock acquisitions follow a consistent global order to prevent deadlock. In the vulnerable code path, the commit_mutex was introduced into the nft reset handler to prevent concurrent modifications, but this created a circular ordering against nfnl_subsys_ipset (used by ipset list operations) and nlk_cb_mutex (used by netlink callback processing). When three threads simultaneously execute nft reset, ipset list, and an iptables-nft rule referencing the 'set' match module, the cycle forms: thread A holds commit_mutex and waits for nfnl_subsys_ipset; thread B holds nfnl_subsys_ipset and waits for nlk_cb_mutex; thread C holds nlk_cb_mutex and waits for commit_mutex. The fix reverts the commit_mutex usage in the reset path entirely, relying on prior patches that already made individual reset handlers safe for concurrent execution. Affected CPE is cpe:2.3:o:linux:linux_kernel across multiple stable branches. No CWE was formally assigned, but this maps to CWE-667 (Improper Locking) and CWE-833 (Deadlock).