A use‑after‑free flaw exists in the Linux kernel netfilter nf_conntrack subsystem. When a NAT helper module such as nf_nat_h323 is unloaded while expectations that reference the helper’s callback function remain active, the kernel fails to clean up those expectation entries. Subsequent packets that match the pending expectation invoke a stale callback pointer, triggering a kernel oops and resulting in a crash. This vulnerability corresponds to CWE-825 on the affected host, but it does not provide a route to arbitrary code execution or data exfiltration.

Any system running the Linux kernel with the netfilter nf_conntrack module and loaded NAT helper modules that register expectations (for example nf_nat applies to all kernel versions before the patch that introduced nf_ct_helper_expectfn_destroy, regardless of whether the modules are built‑in or loadable. The issue is only triggered if the helper module is unloaded while live expectations exist.

The CVSS score is 5.5, indicating moderate severity for a denial‑of‑service impact. The EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires CAP_SYS_MODULE to unload a kernel module, meaning only privileged users or privileged kernel code can trigger the flaw. When successfully triggered, the kernel crashes, causing a reboot or out‑of‑service state, but no privilege escalation or arbitrary code execution is possible.