In the Linux kernel's netfilter nf_conntrack module, the processing of TCP SACK options mistakenly assumes the option data is 4-byte aligned. By casting the pointer to a 32-bit big-endian type and dereferencing it, the kernel can read beyond the intended bounds, which can corrupt memory and eventually cause a kernel panic. The flaw is a classic unaligned memory access vulnerability and is classified as CWE-684.

The flaw exists in the Linux kernel's netfilter nf_conntrack component on all kernel releases before the fixes committed in the referenced Git revisions (4abc1af7ac209c066f4e5dd75cdd56876e5829a9, 7ecfa46a536578a7ed335ddf31a854127268c27c, d3bf9eae486490832bd08fd62ab0ac601f346bd4). Systems running those older kernel versions are potentially affected; newer kernels incorporate get_unaligned_be32() to safely read the SACK data.

The CVSS score is not available and the EPSS score is not reported, but the kernel context and lack of a local-privilege prerequisite suggest a high impact. A remote attacker with network access can craft a TCP segment containing a misaligned SACK option; delivery of such a packet triggers the unsafe read and can cause a denial of service. Because the flaw is exercised during normal packet processing, the attack vector is likely remote over the network, and the vulnerability has not yet been listed in the CISA KEV catalog.