The bug centers on improper reference counting of the nf_ct_timeout structure within the Linux netfilter conntrack subsystem. The patch removed an outdated refcount for the control‑plane reference to timeout policies, causing a timeout policy to be released once the last conntrack entry referencing it dropped its refcount. This can result in the premature removal of a custom timeout policy that is still in use by iptables rules or other conntrack entries, leading to unexpected changes in connection‑tracking behavior and possible loss of network traffic handling. The weakness is an instance of CWE-911 (Controlled Missing Release of a Resource).

All Linux systems whose kernels include the vulnerable netfilter and conntrack implementation are potentially affected. The policy changes apply to any kernel that implements the nf_ct_timeout handling as described in the source changes; specific version numbers are not listed in the advisory, so any kernel containing the referenced implementation is at risk.

The CV score of 7.8 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a very low exploitation probability. The bug does not provide a remote code‑execution path; it is a kernel‑level defect that would require local or privileged kernel access to trigger. Even so, the common consequence is a denial of service or abnormal network traffic handling on the host. Because the issue is contained to kernel internals and lacks publicly available exploit code, the immediate risk is limited but still significant for exposed services reliant on the affected conntrack behavior.