The vulnerability involves a flaw in the Linux kernel’s netfilter conntrack subsystem where the cleanup routine can become blocked if fragmented packets contain a frag_list that still holds a reference to an nf_conn object. This reference leak prevents the automatic reclamation of conntrack entries, leading to a hung cleanup process and potential exhaustion of kernel resources. The primary security consequence is a denial‑of‑service condition that can affect all processes using conntrack, potentially causing the kernel to become unresponsive or to consume excessive memory.

The issue applies to the open source Linux kernel, specifically the 6.18 stable release and the 6.19 release candidate series (rc1 through rc8). The CPE list confirms coverage for 6.18 and all 6.19 RC versions. Any distribution shipping one of these kernels may be impacted until a patch that removes the lingering frag_list reference is applied.

The CVSS score of 5.5 places the bug in the moderate range, and the EPSS indicates an exploitation probability of less than 1 %. The vulnerability is not listed in the CISA KEV catalog at this time. Exploitation requires an attacker to generate traffic that causes fragmented packets to be reassembled into a skb with a frag_list that holds an nf_conn reference, which usually occurs in normal network traffic. Because the flaw resides in core kernel link‑layer handling, the attack vector is internal to the host and would typically require sufficient traffic volume or a targeted fragmentation campaign. Consequently the risk is moderate, but the low probability of exploitation mitigates the urgency for immediate patching in typical environments.