A subtle misstep in nftables object handling created a classic kernel-level use‑after‑free that has since rippled through distributions and cloud images: an nft object or expression could point to a set in a different nft table, and when that table was removed the remaining dangling reference...