The Linux kernel’s netfilter ctnetlink subsystem ignores user‑specified helpers when creating new expectations, causing an out‑of‑bounds read. This overflow can expose kernel memory contents to a process that interacts with netlink, potentially revealing sensitive data and aiding further compromise. The weakness is an improper input validation leading to a buffer over‑read, specifically CWE‑119, CWE‑20, and CWE‑125.

All Linux kernel releases that include the netfilter conntrack expectation code are affected. The vulnerability applies to any system that enables netfilter and uses netlink to create expectations, regardless of specific version identifiers.

The CVSS score is 7.0 and EPSS is unavailable, so the precise severity is not fully quantified, but the impact is significant. Memory disclosure from kernel space can aid privilege escalation or reconnaissance. The likely attack vector is local: an attacker needs the ability to send crafted netlink messages, which typically requires privileged or compromised processes. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet.