In the Linux kernel's traffic‑control subsystem, the act_ct helper contains two error paths where the cleanup for nf_connlabels reference counts is omitted. This is a resource‑leak weakness (CWE-772). When RTM_NEWACTION with TCA_CT_LABELS fails, the driver increments net->ct.labels_used but never decrements it, causing a persistent reference count leak. The result is a gradual build‑up of unused nf_connlabels objects which can exhaust kernel resources and degrade network tracking capabilities.

The flaw exists in every Linux kernel that implements the act_ct module before the commit that added the missing error‑path cleanup. The affected product is the Linux kernel itself; no specific sub‑version was listed in the advisory, so all kernels prior to the patch are considered vulnerable. The fault can be triggered by any code with CAP_NET_ADMIN permission on a network namespace, including user namespaces on kernels that allow default‑userns.

The vulnerability requires CAP_NET_ADMIN privileges within a network namespace, which an unprivileged user can obtain via a user namespace. The flaw is a moderate‑severity resource‑leak with a CVSS score of 5.5; its exploitation can lead to denial‑of‑service by exhausting nf_conntrack label objects. The EPSS score is below 1% and the vulnerability is not listed in CISA's KEV catalog, indicating that it is not currently widely exploited. The risk remains moderate, and the exploitability depends on obtaining CAP_NET_ADMIN within the target namespace.