net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows
local users to gain privileges because of a heap out-of-bounds write. This
is related to nf_tables_offload.

Nick Gregory discovered that the Linux kernel incorrectly handled network
offload functionality. A local attacker could use this to cause a denial of
service or possibly execute arbitrary code.

Disable unprivileged user namespaces to restrict access to privileged
users (have CAP_NET_ADMIN) via the kernel.unprivileged_userns_clone
sysctl:

$ sudo sysctl kernel.unprivileged_userns_clone=0