The vulnerability originates in the netfilter ctnetlink module of the Linux kernel. During a multi‑round conntrack dump, a connection tracking object is freed prematurely because its reference counter is not retained between dump rounds. The subsequent callback dereferences the freed object, creating a use‑after‑free that can corrupt kernel memory. If an attacker can trigger this callback, the corruption could lead to kernel crash or potentially arbitrary code execution, elevating privileges on the affected host.

Affected systems are Linux kernel releases before the patch that adds .start and .done callbacks to ctnetlink_dump_exp_ct(). The problematic code is present in kernel versions such as 7.0.0‑rc2+, as indicated by the KASAN logs. The issue is present in the primary Linux kernel distribution; no vendor‑specific product versions are listed beyond Linux:Linux. Thus any system running an unpatched Linux kernel is at risk.

The CVSS score of 7.8 indicates a high severity risk. EPSS less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not cataloged in the CISA KEV list. The attack vector is a netlink interface that is normally restricted to privileged users, meaning that local users with sufficient privileges could trigger the dump and exercise the use‑after‑free. For non‑privileged users the path is less clear, but the presence of a kernel memory corruption vulnerability still warrants immediate attention.