In the Linux kernel, missing netlink policy checks in the conntrack subsystem allow a crafted netlink message to set the SCTP state value or an invalid tuple hash index directly. The kernel then performs an out‑of‑bounds read on the nf_conn object, exposing portions of kernel memory. The flaw is a classical buffer overread (CWE‑125) and potentially an out‑of‑bounds write (CWE‑787), both resulting from the missing policy validation that accepts user‑supplied attributes without checking their validity. This can leak kernel addresses, user credentials, or other sensitive data, but it does not provide arbitrary code execution. The description indicates that the fault manifests when the kernel processes the user‑supplied attributes without validation.

All Linux kernel releases that have not incorporated the patch commits adding netlink policy validation are affected. This includes any distribution running an unmodified Linux kernel built before the relevant commit. No specific version list is provided, so any kernel older than the commit is at risk.

The CVSS score of 7.1 denotes high severity, and the EPSS score of less than 1 % suggests exploitation opportunities are rare. It is inferred that an attacker must be able to send netlink commands with CAP_NET_ADMIN or otherwise gain privileged local access to trigger the fault. The flaw is listed outside the CISA KEV catalog and, being an out‑of‑bounds read/write, generally leads to information disclosure unless chained to other weaknesses.