A use‑after‑free bug in the Linux kernel’s netfilter nf_conntrack_helper unregister path causes the helper object to be freed while expectations still reference it. Subsequent packet handling or diagnostics access the freed memory, leading to kernel crashes or, in the worst case, privilege escalation. The flaw is a memory corruption due to improper cleanup of kernel data structures, identified as CWE‑416 (Use After Free) and CWE‑459 (Release After Use of Resource).

Linux kernel installations using the nf_conntrack_helper module before the fix are vulnerable. Specifically, kernel releases 7.0 release candidates 1 through 6 (rc1–rc6) are known to contain the flaw. Any kernel build that predates the commit which correctly passes the helper pointer during cleanup, including prior 7.x releases, is also at risk.

The CVSS score of 7.8 indicates high severity and, coupled with an EPSS score of < 1% and absence from CISA’s KEV catalog, the use‑after‑free nature suggests a high potential for denial of service or privilege escalation. The attack vector is likely local or network based, involving unusual or malicious connection‑tracking helper usage that triggers the unregister routine. Because any packet that causes the helper to be removed can expose the flaw, the risk remains significant for systems running vulnerable netfilter configurations.