The vulnerability arises from a reference imbalance in the connection tracking functions used by BPF programs. The kernel reads the network namespace identifier from the opts structure at two separate points, acquiring and releasing a reference on separate CPU cores. If a concurrent update occurs, the put operation may run without a matching get, leaking a reference. Repeated mismatches can destroy a live namespace and later crash the kernel with a general protection fault or KASAN null pointer dereference. The crash manifests as a kernel Oops and may lead to a system reboot, representing a denial of service. The weakness is a reference‑counting bug that can be triggered by any BPF program that calls the affected conntrack functions.

The flaw resides in the Linux kernel. The affected product is the Linux kernel; the specific versions are not listed in the advisory, so all kernel releases prior to the fix may be vulnerable. The CNA vendor/product entry lists "Linux:Linux"; no further version detail is provided.

The CVSS score is 7.8, indicating a high severity vulnerability. The EPSS score is < 1%, and the issue is not currently listed in the CISA KEV database, indicating no known widespread exploitation yet. The likely attack vector is local: an attacker with the ability to load a BPF program (typically root or another privileged user) could trigger the flaw by crafting or executing a BPF script that uses the conntrack kfuncs. Because the bug leads to a crash, the primary consequence is availability loss rather than confidentiality or integrity compromise.