The vulnerability exists in the Linux kernel’s netfilter nf_conntrack_expect subsystem and involves a race between the legacy timer API and the newer conntrack garbage collector. When an expectation expires, the timer API may delete the master connection reference while the garbage collector is still iterating over the expectations list, potentially causing an expectation to dereference a stale master pointer. This use‑after‑free scenario could corrupt kernel memory and result in a crash or a path to arbitrary code execution with kernel privileges if an attacker can exercise the vulnerable code path.

All standard Linux kernel builds that contain the nf_conntrack_expect code and have not applied the recent patch that replaces the timer mechanism with a garbage‑collection worker. The bug is present in the default kernel tree and therefore affects every distribution or vendor that ships a kernel without the update, including all mainstream Linux distributions and embedded systems.

No CVSS or EPSS score is published for this issue, and it is not listed in the CISA KEV catalog. The patch description indicates a kernel use‑after‑free, which is a high‑severity flaw in a privileged component, but no public exploit or detailed exploitation method is documented. The potential impact involves kernel crashes or elevation of privilege if an attacker can trigger the expectation handling path while the race condition occurs. Because the exploitation requirements are not described in the advisory, the exact attack vector cannot be stated definitively.