The vulnerability resides in the Linux kernel’s netfilter nft_ct component. When the nft_ct module is unloaded while packets are still queued, the kernel can be left holding stale references to conntrack templates, timeout policies, or helper objects. Based on the description, it is inferred that this improper cleanup can cause a use‑after‑free or dereference of a dangling pointer, potentially leading to a kernel crash and denial of service. Based on the description, it is inferred that an attacker with the ability to unload the module could trigger this condition.

Based on the description, it is inferred that all Linux kernel versions that compile the nft_ct module without the patch are potentially affected. Systems that load nft_ct (the connection‑tracking component of nftables) and may unload it—for example, during module reloads or by a privileged user—are at risk. The exact kernel versions are not specified in the advisory.

The severity is high because a kernel crash equates to a full denial of service. No EPSS score is available, which indicates that public exploitation has not been documented, yet based on the description it is inferred that the condition can be exploited by a local privileged attacker who can unload kernel modules. The vulnerability is not listed in the CISA KEV catalog, but it remains a critical issue due to the nature of kernel pointer misuse.