The vulnerability arises when a connection tracking helper is assigned to a connection that also has a NAT binding, but the required sequence adjustment extension is not added. The missing adjustment causes the kernel to generate packets with incorrect TCP sequence or acknowledgment numbers, leading to failures when an FTP client requests passive mode. An adversary with network access could force repeated FTP failures or potentially hijack an FTP session, resulting in a denial‑of‑service condition for the affected service. The weakness can be categorized as a protocol handling defect that compromises TCP’s sequence‑number integrity, as reflected in the associated CWE identifiers.

All Linux kernel installations are listed as affected, but the exact kernel version range is not provided in the data. The change was introduced in the netfilter conntrack subsystem and would impact any distribution using a kernel that has not yet incorporated the patch for the missing seqadj extension.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests exploitation is unlikely in the near term, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector requires the attacker to be positioned on the network path between an FTP client and server, able to manipulate packets so that the conntrack helper is invoked on a NATed connection. No public exploit has been reported, so the risk is mainly operational. Existing network filters that enforce stricter stateful inspection or that disable the FTP helper could mitigate the pain points while awaiting an upstream fix.