The flaw lies in the nf_conntrack_expect module of the Linux kernel where the expect->helper pointer is used without proper locking or reference handling during nfct_help() calls. This unsafe dereference can trigger a kernel crash, causing a system‑wide denial of service. The weakness is categorized as a null pointer dereference (CWE‑476).

Linux kernels that incorporate the nf_conntrack_expect component are affected. The affected releases include all kernel versions that contain this code, with the most recent patches applied in Linux kernel 7.0 and newer. No specific vendor or patch level is listed beyond the kernel version; any unpatched kernel running the nf_conntrack_predict module may be vulnerable.

The CVSS score of 9.8 marks the vulnerability as critical. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not present in CISA’s KEV catalog, suggesting no public exploits are known. The likely attack vector requires local or privileged access to the ctnetlink or /proc interfaces that expose helper names, so the attacker would need sufficient permissions to manipulate network expectations. Successful exploitation would likely result in a kernel panic or crash, disrupting all host services.