The Linux kernel netfilter nft_set_rbtree component had a flaw in its partial overlap detection logic for anonymous sets. Userspace optimizes interval representation by omitting the end element for adjacent intervals, causing the kernel to skip overlap checks on start elements. This allowed intervals with the same start but overlapping end points (e.g., intervals A-B and A-C where C < B) to be added without detection. The fix restores the check on overlapping start elements to ensure such overlaps are detected and reported, preventing inconsistent interval sets.

This vulnerability can cause the kernel to accept overlapping intervals in anonymous sets, potentially leading to inconsistent or unexpected behavior in netfilter operations. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability, suggesting possible denial of service or disruption scenarios. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a kernel-level issue, applying official kernel updates when available is recommended to ensure the fix is applied. Until then, monitor vendor advisories for patches addressing this specific issue.