The flaw in the Linux kernel’s netfilter conntrack module is a classic instance of state machine manipulation, classified as CWE-358. It allows a crafted TCP reset packet to forcibly transition a tracked connection to the CLOSE state without confirming that the packet is a legitimate response to a previous SYN. After observing an initial SYN, an attacker can send an RST with an invalid sequence number; the kernel interprets it as a response to the outgoing SYN, causing premature termination of the NAT entry and disrupting active flows.

All installations running a Linux kernel version that has not yet incorporated the upstream patch are affected. This includes most mainstream distributions and embedded systems where the kernel is compiled from source or provided via package repositories that have not updated to the latest stable release that includes the fix.

With a CVSS score of 8.2, the vulnerability is high severity, but the EPSS score of less than 1% indicates a low probability of exploitation at present. It is not listed in the CISA KEV catalog. Based on the description, an attacker can send the malicious packet sequence from an unprivileged host across any network interface that the victim accepts, without needing authentication. The exploit path involves only the transmission of a crafted SYN followed by an invalid‑sequence RST, so the attack can be performed over the public internet or internal networks when the target is reachable.