Linux Kernel EUVD-2026-32367

Exploitation requires a local account with sufficient privileges to run nft reset commands and interact with the netfilter/ipset subsystems, which typically requires CAP_NET_ADMIN or equivalent. Three specific operations must be triggered concurrently: an nft reset operation, an ipset list operation, and evaluation of an active iptables-nft rule that references the '-m set' (ipset match) module. All three must be executing simultaneously for the lock cycle to form. Systems not using ipset-based iptables rules or not running concurrent nft reset operations are not exploitable. The race is constrained to specific kernel scheduling windows, making reliable exploitation difficult in practice. Remote exploitation is not possible; physical or shell access to the target system is required.

Real-world risk is low despite the ubiquity of the Linux kernel. The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H is internally consistent: local access and low-privilege credentials are required to trigger the condition, availability is the sole impact, and no confidentiality or integrity loss occurs. EPSS at 0.02% (5th percentile) confirms this is not being actively targeted. The vulnerability is not listed in CISA KEV. No POC exploit has been identified. A notable discrepancy exists: the ENISA EUVD tags include 'Information Disclosure,' which directly conflicts with the CVSS C:N metric; the CVSS vector and description do not support any information disclosure impact, and the tag appears to be a classification error. Exploitation requires triggering a specific concurrent scheduling race between three distinct kernel subsystem operations, which reduces practical exploitability even for local attackers. Overall, this is a low operational priority: patch in routine maintenance cycles rather than emergency response.

A local user with low privileges on a multi-tenant Linux host (e.g., a container host or shared server) simultaneously issues an nft reset command, triggers an ipset list operation, and has an active iptables-nft rule using the '-m set' module being evaluated. The concurrent acquisition of commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex in conflicting orders causes a kernel deadlock, hanging or crashing affected kernel threads and potentially rendering the system unresponsive. No public POC exploit exists; reproduction requires careful orchestration of concurrent operations.