The vulnerability arises from a double‑free bug in the Linux kernel's NAT keep‑alive implementation. When nat_keepalive_send() receives an error after a packet has already been handed to the output path, the same socket buffer (skb) is freed twice. This undefined behavior can corrupt kernel memory and trigger a crash, resulting in a denial‑of‑service or potential escalation of privileges.

The bug affects any Linux kernel that contains the nat_keepalive_send interface for IPv4 and IPv6, which is present in all current Linux releases. No specific version numbers are listed in the advisory; therefore all kernel versions prior to the patch are potentially vulnerable.

The vulnerability has a CVSS score of 9.8, indicating critical severity, while the EPSS score is below 1 % and it is not included in CISA's KEV catalog. The likely attack vector is inferred to be an adversary that can trigger a send error in the NAT path, such as by manipulating NAT helper traffic or crafting packets that cause the helper to fail. Because this requires interaction with the kernel networking stack, remote exploitation is not guaranteed without additional privileges or a flaw that allows arbitrary packet injection. Nevertheless, the potential for kernel crash and memory corruption warrants immediate action.