The Linux kernel netfilter nf_tables component had a flaw where during transaction processing, multiple catchall elements (one live and one pending) might exist. If the map containing these elements is removed, the code failed to toggle all catchall elements, only toggling the first viable candidate. This led to kernel warnings and potential instability due to improper element release. The vulnerability is addressed by modifying the code to walk all pending catchall elements and toggle them appropriately during cleanup.

The vulnerability can cause kernel warnings and potentially lead to denial of service or system instability due to improper handling of nf_tables catchall elements during transaction processing. The CVSS vector indicates local attack vector with low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability with high severity.

Patch status is not yet confirmed — check the vendor advisory SUSE-SU-2026:2588-1 for current remediation guidance. Since this is a Linux kernel vulnerability, applying official kernel updates from the vendor or distribution is the recommended mitigation once available.