An unaligned 32‑bit read in the Linux kernel’s netfilter nf_conntrack TCP SACK processing path can cause the kernel to read beyond the intended memory bounds, potentially corrupting kernel state or producing incorrect packet handling. The code incorrectly casts the SACK option stream pointer to an aligned 32‑bit type; using get_unaligned_be32() would perform the read safely.

The flaw exists in the Linux kernel’s netfilter nf_conntrack module on all releases prior to the commits that replace the aligned read with get_unaligned_be32() in the tcp_sack function. All distributions that ship such kernel versions without the patch are affected.

The CVSS score of 7.5 indicates moderate to high severity. The EPSS score of less than 1% suggests exploitation is currently unlikely. Based on the description, it is inferred that the vulnerability can be triggered by network traffic carrying TCP packets with SACK options that exercise the timestamp‑only fast path; thus the attack vector is remote via the network. The vulnerability is not listed in the CISA KEV catalog.