The vulnerability resides in the Linux kernel’s netfilter nft_ct component. When the nft_ct module is unloaded while packets are still queued, the kernel can be left holding stale references to conntrack templates, timeout policies, or helper objects. The improper cleanup can cause a use‑after‑free or dereference of a dangling pointer, potentially leading to a kernel crash and denial of service. Based on the description, it is inferred that an attacker with the ability to unload the module could trigger this condition.

Based on the description, all Linux kernel versions that compile the nft_ct module without the patch are potentially affected. Systems that load nft_ct (the connection‑tracking component of nftables) and may unload it—for example, during module reloads or by a privileged user—are at risk. The exact kernel versions are not specified in the advisory.

The CVSS score is 7.8, indicating a high‑impact vulnerability. The EPSS score is <1%, suggesting a low probability of public exploitation. Based on the description, it is inferred that a local privileged attacker who can unload the nft_ct module could trigger the condition, which leads to a use‑after‑free and potentially a kernel crash and denial of service. The vulnerability is not listed in the CISA KEV catalog, but its nature of dangling pointer misuse makes it a serious concern.