Linux Kernel EUVD-2026-64382

Exploitation strictly requires that the target Linux system has netfilter flowtable offload actively configured - specifically, nft_flow_offload action rules must be present in nftables and the nf_flow_table kernel module (plus nf_flow_table_ipv4 or nf_flow_table_ipv6) must be loaded. This is a non-default, administrator-deployed configuration found primarily on Linux-based routers, NAT gateways, and stateful firewalls optimized for throughput. Standard Linux servers, desktops, or containers without explicit flow offload rules are not affected regardless of kernel version. Alternatively, the XFRM IPsec offload path must be configured to trigger the same flaw via that vector. The attacker must be able to route network packets through the configured offload path - a prerequisite that limits exploitation to networks where the attacker has meaningful traffic visibility toward the appliance. The CVSS PR:N metric is accurate in that no authentication is required from the attacker, but the flowtable or XFRM configuration on the target is a hard prerequisite that limits realistic exposure.

The NVD-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) overstates realistic risk by setting AC:L, which implies the vulnerability is trivially triggerable under default conditions. In practice, nf_flow_table offload must be explicitly configured via nftables flow offload rules - a non-default deployment pattern most common in Linux-based routers, firewalls, or NAT gateways. AC:H is a more accurate representation. Independently, EPSS of 0.21% at the 11th percentile signals very low observed exploitation probability, consistent with the specialized configuration prerequisite and the absence of public exploit code. The vulnerability is not in CISA KEV, and no POC has been identified. Real-world priority is therefore highest for operators of Linux-based network appliances explicitly using nft_flow_offload, and low to negligible for general-purpose Linux servers. The CVSS availability-high rating is justified for affected deployments as a reference leak DoS in the kernel networking path could cause kernel panic or service disruption.

An attacker sends a sustained stream of network packets to a Linux router or firewall where nftables flow offload rules are configured. The packets enter the nf_flow_offload_ip_hook() processing path carrying a ref-counted dst_entry from an earlier routing step; the hook calls skb_dst_set_noref() without first dropping the existing reference, leaking one dst_entry reference count per packet. Over time, accumulated leaks trigger the DEBUG_NET_WARN_ON_ONCE assertion or exhaust kernel memory structures, resulting in kernel instability or panic. No public exploit code has been identified at time of analysis.