In the Linux kernel, a flaw in the netfilter conntrack implementation permits a NULL pointer dereference. The vulnerability is triggered when connection tracking extensions that are no longer in use are still instantiated for unconfirmed conntrack entries. Because the code mistakenly dereferences the extension without a NULL check, a crafted packet that generates such an unconfirmed state can cause the kernel to crash, resulting in a denial‑of‑service condition that a local attacker or one controlling network traffic to the host may exploit.

The flaw appears in any Linux system that runs a kernel version which includes the reverted genid extension code. The vendor list indicates the issue is present in Linux:Linux across all distributions. No specific version range is supplied, so all kernels carrying the commit are affected until a patch removes the regression.

Because the vulnerability is a NULL pointer dereference it is straightforward for an exploit to trigger a crash if the attacker can produce the appropriate conntrack state. No CVSS or EPSS scores are listed and the flaw is not in the CISA KEV catalog, implying no confirmed public exploitation yet. Nonetheless, the potential for an attacker who can influence network traffic to a vulnerable host to cause the crash gives it a moderate to high risk profile; administrators should treat it as a serious DoS vector until an official fix is available.