In the Linux kernel’s netfilter xt_CT module, templates that control packet tracking can be removed while packets are queued, causing all pending enqueued packets to be dropped. This loss of packets can result in service disruption for applications relying on the netfilter connection tracking feature. The weakness involves improper cleanup of resources and memory, which is categorized as CWE‑416 (Dereference of Freed Pointer) and CWE‑911 (Improper Deallocation of Memory). The description indicates that dropping queued packets is the consequence, leading to a denial‑of‑service scenario.

Affected systems include all Linux kernels that incorporate the netfilter xt_CT module, particularly those with versions listed in the CPE data such as kernel 3.4 and the 7.0 release candidates (rc1 through rc7). The generic CPE entry for Linux kernel also covers any newer releases that have not yet been patched. Therefore, any Linux distribution using a kernel in these ranges is impacted until the patch is applied.

The vulnerability has a CVSS score of 7.8, indicating moderate to high severity. The EPSS score is listed as less than 1 %, suggesting a low probability of exploitation at present. It is not cataloged in the CISA KEV list. The likely attack vector involves privileged manipulation of the kernel, such as unloading a helper module or triggering nfnetlink_cttimeout, to remove a template while traffic is being processed. Because the flaw manifests when resources are released prematurely, an attacker with kernel‑level access could force packet loss, leading to a denial of service.