The Linux kernel’s netfilter xt_cluster module incorrectly assumes that any non‑NULL result from nf_ct_get() represents a fully initialized connection‑tracking entry. When a raw table CT target attaches a template conntrack to a packet before the normal conntrack flow, the template lacks a valid tuple and has a zeroed l3num field. This causes xt_cluster_hash() to trigger a WARN_ON(), which can lead to memory corruption and a kernel crash, thereby denying service to the host.

All Linux kernels that include the netfilter xt_cluster target are potentially affected. The CVE data does not list specific kernel versions that have been patched, so system administrators should verify whether their current kernel revision incorporates the fix that rejects template conntracks before hashing.

Exploitation would require sending crafted network traffic that activates a raw table CT target within netfilter, making this a network‑based attack vector. The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, meaning no widespread known exploitation, but the potential kernel crash warrants prompt remediation.