An improper teardown of the netfilter cttimeout module caused the module to unregister per‑net operations before clearing a hook that is still referenced by policy lookup functions. This sequence leads to a use‑after‑free condition in the kernel. The flaw may surface when the module is unloaded concurrently with another CPU performing a timeout lookup, causing the hook to point at freed memory. An attacker could trigger the interleaving to cause a kernel panic or potentially execute arbitrary code with kernel privileges if the freed memory is subsequently corrupted.

The defect is present in the Linux kernel, affecting all configurations that enable the nfnetlink_cttimeout module (netfilter cttimeout). The vulnerability applies to any kernel version that includes this module prior to the inclusion of the hotpatch described in the description. No specific kernel release is listed, so all kernels prior to being patched are considered affected.

Because the flaw is a kernel use‑after‑free, compromise could lead to privilege escalation. The CVSS score is 7, indicating a high severity, but the EPSS score is < 1% and the vulnerability is not listed in KEV. The likely attack vector is that an attacker would need the ability to load or unload kernel modules while another process performs concurrent timeout lookups; local users with privileged module loading rights could trigger the interleaving. The flaw occurs only under specific timing conditions, so an attacker must orchestrate such timing. Once the use‑after‑free is triggered, the kernel may crash or allow the attacker to hijack execution flow, depending on memory contents.