The vulnerability stems from improper reference counting in the netfilter ctnetlink expectation dumper. The kernel code no longer protects the expectation object with a stable reference count, instead using a cookie value. When the reference count is incremented, there is a race where the same expectation may be incremented twice, leading to a double‑increment that eventually results in a memory leak. This leak can consume kernel memory over time, potentially exhausting resources and degrading system stability.

All Linux kernel distributions may be affected because the CPEs cover the generic kernel and the 6.17 release candidate. The flaw exists in the kernel's netfilter implementation, so any system running a vulnerable kernel version prior to the patch is susceptible. Native distributions should check the vendor’s kernel update page for the specific commit or kernel release that contains the fix.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is local privileged or kernel-level code that triggers expectation dumps; it does not appear to be exploitable remotely without additional privileges. Therefore, the risk is moderate, but the probability of exploitation remains low unless a privileged user or another root exploit is present.