The Linux kernel’s netfilter nf_conntrack_expect subsystem suffers a race between the legacy timer API and the newer garbage‑collection worker. When an expectation expires, the timer may delete its master connection reference while the GC worker still iterates over the expectation list, causing a use‑after‑free and potential kernel memory corruption. This can lead to an unexpected kernel crash. Based on the description, it is inferred that exploitation could also lead to privilege escalation.

All standard Linux kernel builds that contain the nf_conntrack_expect code and have not applied the recent patch that replaces the timer mechanism with a garbage‑collection worker. The bug is present in the default kernel tree and therefore affects every distribution or vendor that ships a kernel without the update, including all mainstream Linux distributions and embedded systems.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of < 1% shows a very low but nonzero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could manipulate packet expectations via network traffic to trigger the vulnerable code path. Exploitation would require controlled network traffic exercising the expectation handling path, potentially from a remote attacker, and would need to trigger the specific race condition. No public exploit is currently documented. Kernel memory corruption could result in a system crash.