A flaw in the Linux kernel’s netfilter nfnetlink_cthelper module allows an out‑of‑bounds read when a netlink dump of connection‑track helpers is performed. The function nfnl_cthelper_dump_table contains a goto restart that jumps past a bounds check, causing the code to read eight bytes beyond the nf_ct_helper_hash array. This untrusted read can leak kernel memory contents and expose sensitive information, as classified under CWE‑1095.

The vulnerable code resides in the Linux kernel. All distributions that ship a kernel version containing the nfnetlink_cthelper implementation are potentially affected until the commit that fixes the logic is applied. No specific vendor version range is provided, so the issue is applicable to all variants of the Linux kernel that include this module.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score is not available, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog, indicating that no active exploits are known. Based on the description, it is inferred that the likely attack vector is a local or privileged process that can trigger a netlink dump of connection‑track helpers, which requires access to the netlink interface. The attack surface is therefore limited to systems running the vulnerable kernel with the nfnetlink_cthelper module enabled.