The flaw resides in the Linux kernel netfilter ctnetlink subsystem where an expectation object can reference a master conntrack entry that may be freed while the expectation is being accessed. Without proper locking, the exp->master pointer becomes dangling, leading to a use‑after‑free that can crash the kernel or allow execution of arbitrary code. The vulnerability is linked to CWE‑366 and CWE‑362.

All Linux kernel releases that contain the unpatched ctnetlink code are affected until the committed fix is applied. The issue impacts any system that utilizes netfilter conntrack expectations via the netlink interface, including firewall and NAT configurations that load the nf_conntrack module.

The CVSS score of 7.8 indicates high intrinsic risk, and the EPSS score of <1% suggests a low likelihood of exploitation. Based on the description, the likely attack vector involves an attacker with the ability to send netlink commands to the ctnetlink interface—typically a local user with CAP_NET_ADMIN or a service exposed to the kernel. No public exploits are documented in the CVE data, but the kernel‑level nature of the flaw means that a successful exploitation could result in a system crash or privilege escalation. The vulnerability is not listed in CISA KEV.