The flaw in the Linux kernel allows an unsigned use of the expect->helper pointer within the nf_conntrack_expect module, leading to unsafe dereferencing when nfct_help() is called without maintaining a reference to the master conntrack. This can result in a kernel dereference of invalid memory, potentially causing a crash or other instability that manifests as a denial of service. The vulnerability lies in the way ctnetlink and /proc interfaces expose helper names without proper locking or reference handling.

All Linux kernel releases that include the nf_conntrack_expect component are affected, as the issue stems from generic kernel networking code. No specific patch level or vendor version is provided, so any system running the current, unpatched kernel is potentially vulnerable.

With a CVSS score of 7.0 the severity is high, yet EPSS data is unavailable and the vulnerability is not listed in CISA's KEV catalog, suggesting no public exploits are known. The likely attack vector requires local or privileged access to the ctnetlink or /proc interfaces, so permission to manipulate network expectations is needed. Exploitation would likely produce a kernel panic or crashing service, enabling denial of service to all users on the host.