A use‑after‑free bug in the Linux kernel’s netfilter nf_conntrack_helper unregister path causes the helper object to be freed while expectations still reference it. Subsequent packet handling or diagnostics access the freed memory, leading to kernel crashes or, in the worst case, privilege escalation. The flaw is a classic example of memory corruption resulting from improper cleanup of kernel data structures.

All Linux kernel installations that include the nf_conntrack_helper module and have not applied the audit commit to correctly pass the helper pointer during cleanup. No specific version range is provided, so any kernel build that predates the fix is potentially affected.

The CVSS score of 7.0 indicates high severity and, coupled with an unavailable EPSS score and absence from CISA’s KEV catalog, the use‑after‑free nature suggests a high potential for denial of service or privilege escalation. The attack vector is likely local or network based, involving unusual or malicious connection‑tracking helper usage that triggers the unregister routine. Because any packet that causes the helper to be removed can expose the flaw, the risk is significant for systems running vulnerable netfilter configurations.