nfqnlmangle in net/netfilter/nfnetlinkqueue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nfqueue verdict with a one-byte nftapayload attribute, an skb_pull can encounter a negative skb->len.