An attacker may send crafted netlink messages to the conntrack subsystem that overwrite the SCTP state or access an invalid tuple hash index. The kernel then reads beyond the boundaries of the netfilter connection object, exposing up to several kilobytes of kernel memory. This out‑of‑bounds read is a classic buffer overread (CWE‑125) and can leak sensitive data such as kernel addresses or user credentials.

All Linux kernel builds before the patch that adds netlink policy validation are affected. The vulnerability is present in the kernel’s netfilter conntrack code and therefore applies to every distribution that ships an unmodified Linux kernel, including major distros such as Ubuntu, CentOS, Debian, RHEL and others. No specific version list is provided in the advisory, so any kernel older than the commit that introduced the fix is at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1 % suggests that exploitation opportunities are expected to be rare. The vulnerability requires the ability to send netlink commands with CAP_NET_ADMIN, so a local attacker who has or can obtain that capability would be able to trigger the fault. The fix is not yet in KEV, and because the flaw is an out‑of‑bounds read rather than an arbitrary code execution, the impact is limited to information disclosure unless combined with further vulnerabilities.