The vulnerability resides in the Linux kernel's netfilter ctnetlink module. When a netlink message omits the CTA_EXPECT_NAT flag, the allocation routine pulls memory from a non‑zeroing slab, leaving fields such as saved_addr and saved_proto uninitialized, reflecting a CWE-824 weakness. A subsequent dump operation then reads these stale values and can expose them to userspace, revealing former NAT configuration data that should not have been disclosed.

All Linux kernel distributions are affected as the flaw exists in core kernel code. No specific kernel version is provided, so any kernel that has not incorporated the commit that zeroes these fields may be vulnerable. Users should verify whether the referenced commit is present in their kernel and, if not, apply the appropriate update.

The CVSS score is 5.5, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, suggesting no known exploitation. The likely attack vector is local via the ctnetlink netlink interface, and the required privilege level is inferred to be local user access capable of sending and reading netlink messages. The inference is marked because the description does not explicitly state the vector or privilege. Exploitation would allow an attacker to read stale NAT configuration data, which may aid in reconnaissance but does not provide direct code execution or privilege escalation.