The Linux kernel's netfilter synproxy component previously lacked proper synchronization when registering hooks on-demand during concurrent additions of iptables targets or nftables expressions. This could lead to race conditions in reference counting of hooks. The vulnerability was addressed by introducing a mutex to serialize access to the reference count control blocks, ensuring thread-safe operations. Although a per-namespace mutex might be more efficient, the fix uses a simpler mutex sufficient for the SYNPROXY target/expression.

The vulnerability can cause a race condition leading to potential denial of service (indicated by CVSS vector with high availability impact). There is no confidentiality or integrity impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves adding a mutex to guard hook reference counting in the synproxy infrastructure. Users should monitor official Linux kernel advisories for patches addressing this issue and apply them when available.