The vulnerability resides in the Linux kernel's netfilter nf_conntrack_irc module, where the parse_dcc() function incorrectly treats the data limit as inclusive. When an IRC message lacks a newline, the code reads a byte beyond the legitimate data boundary. This stray read yields an uninitialized or stale value; if the byte happens to be an ASCII digit, the subsequent conversion routine treats it as part of a DCC IP address or port, producing an incorrect expectation in the connection tracking table. The consequence is a corrupted conntrack entry that may cause legitimate connections to be dropped, misdirected, or, in the worst case, allow an attacker to manipulate packet filtering by forging expected addresses.

All Linux kernel releases that have not yet applied the fix contain the vulnerable code. The issue is present in the core nf_conntrack_irc subsystem and impacts any distribution using the affected kernel version. No specific vendor or product version list is supplied, but the bug was resolved in a later stable kernel revision and thereafter includes the corrected loop logic.

The vulnerability is an out‑of‑bounds read (CWE‑788) and the patch merely changes a loop boundary. No EPSS data or KEV listing is available, indicating low to moderate exposure thus far. An attacker would need to send crafted IRC traffic that reaches the vulnerable nf_conntrack_irc code, which can be achieved from an external network listening on the standard IRC ports. Successful exploitation requires no elevated privileges, but the impact is limited to manipulation of conntrack state for that traffic. Given the absence of a public exploit and the requirement for traffic on a specific protocol, the likelihood of exploitation remains modest.