The Linux kernel’s act_ct action module fails to free sk_buff structures when header sanity checks reject a packet, resulting in orphaned sk_buff and data buffers. Each malformed packet leaves one sk_buff and its payload unreclaimed, leading to an unbounded memory leak. The kernel’s drop statistics also incorrectly report a drop for packets that were never processed, potentially masking denial of service conditions.

All Linux kernels that implement the act_ct action in the traffic control subsystem are affected, as demonstrated in version 7.2‑rc6 and earlier releases. The vulnerability applies to any distribution shipping the stock kernel without the patch, regardless of kernel version, until the flaw is remedied.

Although the vulnerability does not grant remote code execution or privilege escalation, the exploit path is straightforward: an attacker can send crafted IPv4 or IPv6 fragments that trigger the header checks, causing the kernel to leak memory. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the lack of an automatic free directly consumes kernel memory, potentially degrading or exhausting system resources. The attack vector is network‑based, originating from malformed packets observed on the affected host’s network interface.