The vulnerability resides in the netfilter nf_nat_sip helper within the Linux kernel. When a cloned or fragmented socket buffer (skb) is reallocated by skb_ensure_writable, the original data pointer is freed. The nf_nat_sip() function, however, continues to use the old pointer when writing a forced destination port and when calling nf_nat_mangle_udp_packet. This results in a use‑after‑free memory corruption that can affect kernel data structures, potentially leading to a crash or providing an avenue for privilege escalation. Additionally, the code may mistakenly invoke nf_nat_mangle_udp_packet on packets that are actually TCP, overwriting critical TCP fields such as the sequence number, which could further destabilize connections or be leveraged for malicious manipulation.

All Linux kernel builds that compile the netfilter nf_nat_sip helper are affected. The CVE does not specify a particular kernel version, so any kernel containing this helper without the recent patch is at risk.

The CVSS score of 9.8 indicates a high‑severity vulnerability that once exploited could completely compromise the host. The EPSS score is less than 1 %, showing a very low probability of active exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. No public exploits have been reported, and the likely attack vector is local or requires an attacker to be able to generate or relay SIP traffic that traverses the affected kernel module, implying that remote exploitation without such conditions is improbable.