The vulnerability occurs in the BPF conntrack helper functions of the Linux kernel, where the code accepts an opts pointer and a size argument but only verifies the memory range defined by the size. After finding an error, the implementation writes to opts->error regardless of whether the provided size includes that field. For sizes that are smaller than the offset of opts->error, this write can occur outside the verifier‑checked range, corrupting kernel memory. The effect is an out‑of‑bounds write that may overwrite critical kernel data structures and potentially enable privilege escalation or cause system instability.

All Linux kernel versions that contain the unpatched BPF conntrack helper code are affected. The issue is present before the patch that guarded writes to opts->error, regardless of the supported 12‑byte or 16‑byte layout. No specific kernel version range is given, so any kernel build that uses these helpers without the recent fix is considered vulnerable.

The CVSS score is 8.8 and the EPSS score is < 1%, while the vulnerability is not yet in the CISA KEV catalog. The impact of corrupting kernel memory is severe, as it may lead to privilege escalation or denial of service. The likely attack vector is local or through privileged user‑space processes that can execute BPF programs or invoke the affected conntrack helpers, given the code operates in kernel space. Because the bug involves a memory write that is controlled by user‑supplied arguments, an attacker who can provide crafted input could trigger the corruption; however, the existence of an active exploit is not confirmed. Nonetheless, the potential for exploitation remains high due to the nature of the memory corruption.