The vulnerability is a memory leak in the Linux kernel’s netfilter bridge module. A conntrack template attached by a bridge nftables ct zone set rule may be overwritten for non‑IPv4 and non‑IPv6 EtherTypes without releasing its reference. The existing template reference remains retained and becomes unreachable, leaking memory each time a non‑IP packet is processed. This leak is a classic instance of improper release of resources (CWE‑401) and can eventually exhaust kernel slab space, potentially leading to denial‑of‑service.

The flaw sits in the kernel’s nf_ct_bridge_pre handling for any bridge that uses nftables conntrack configuration. It affects all Linux kernel builds that include the bridge nftables patch set; no specific version range is listed, so the flaw is presumed present in all current kernel releases that compile the affected code path. Systems running a Linux kernel with the bridge nftables module enabled and traffic that can carry non‑IP EtherTypes (such as ARP, RARP, or custom protocols) are susceptible.

The EPSS score is unavailable and the vulnerability is not in the CISA KEV catalog. Although there is no publicly released CVSS score, the memory exhaustion potential suggests a high severity, particularly for systems that run dense bridge traffic. The likely attack vector requires an attacker who can inject non‑IP frames into a bridged interface that is processing nftables conntrack zone rules. A sustained flood of such frames could drive the kernel into OOM termination or cause system instability. Because no publicly known exploit exists, but the condition is straightforward to trigger, the risk remains significant for exposed bridge environments.