The vulnerability resides in the Linux kernel's netfilter ctnetlink module. When a netlink message omits the CTA_EXPECT_NAT flag, the allocation routine pulls memory from a non‑zeroing slab, leaving fields such as saved_addr and saved_proto uninitialized, reflecting a CWE-824 weakness; the list also contains NVD‑CWE‑noinfo, indicating incomplete or missing CWE mapping. A subsequent dump operation then reads these stale values and can expose them to userspace, revealing former NAT configuration data that should not have been disclosed.

The flaw affects Linux kernel releases 7.0 RC1 through RC6, as indicated by the CPE strings. Kernels from those releases that lack the zeroing commit are vulnerable. Users should verify whether their kernel includes the commit that zeroes the uninitialized expectation fields and, if not, apply the appropriate update.

The CVSS score is 5.5, indicating moderate severity. EPSS data is < 1%, and the vulnerability is not listed in CISA KEV, suggesting no known exploitation. The likely attack vector is local via the ctnetlink netlink interface, and the required privilege level is inferred to be local user access capable of sending and reading netlink messages. The inference is marked because the description does not explicitly state the vector or privilege. Exploitation would allow an attacker to read stale NAT configuration data, which may aid in reconnaissance but does not provide direct code execution or privilege escalation. This flaw affects Linux kernel versions 7.0 RC1 through RC6, as identified by the listed CPEs, and any kernel derived from those that do not include the patch.