pam_authnft contains a heap buffer over‑read in the peer_lookup_tcp function. A crafted NETLINK_SOCK_DIAG reply can bypass the message‑size check, causing the code to dereference beyond the boundary of the allocated buffer. This memory corruption can be leveraged by an attacker to overwrite critical data structures or trigger a crash, and depending on the context, may enable arbitrary code execution.

The vulnerability affects the identd-ng PAM session module pam_authnft on all versions released before 0.2.0‑alpha. This includes any system that has the module installed and configured to bind nftables firewall rules to authenticated sessions via cgroupv2 inodes.

The CVSS score of 8.7 indicates high severity. EPSS data is not available, so the exploitation likelihood is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The attack requires sending a carefully crafted NETLINK_SOCK_DIAG reply, implying a local context where the attacker can influence netlink traffic or has sufficient privileges to cause the module to process the reply. Because the flaw can lead to memory corruption, the potential impact is significant, especially on systems where pam_authnft is active.