The vulnerability arises when a conntrack helper is assigned to a connection that also has a NAT binding, but the required sequence adjustment extension is not added. The missing adjustment causes the kernel to generate packets with incorrect TCP sequence or acknowledgment numbers, leading to failures when the FTP control connection requests passive mode. An attacker with network access between client and server could force repeated FTP failures or potentially hijack an FTP session, resulting in a denial‑of‑service condition for the affected service. The weakness can be categorized as a protocol handling defect that breaches TCP’s sequence‑number integrity, as reflected in the associated CWE identifiers.

All Linux kernel installations are listed as affected, but the exact kernel version range is not provided in the data. The change was introduced in the netfilter conntrack subsystem and would impact any distribution using a kernel that has not yet incorporated the patch for the missing seqadj extension.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests exploitation is unlikely in the near term, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector requires an attacker to be positioned on the network path between an FTP client and server, able to manipulate packets so that the conntrack helper is invoked on a NATed connection. No public exploit has been reported, so the risk is mainly operational. Existing network filters that enforce stricter stateful inspection or that disable the FTP helper could mitigate the pain points while awaiting an upstream fix.