In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zero…

{
                    "vendor": "n/a",
                    "product": "Linux kernel netfilter subsystem.",
                    "versions": [
                        {
                            "version": "Fixed in 6.0-rc1",
                            "status": "affected"
                        }
                    ]
                }