In the Linux kernel’s netfilter nf_nat subsystem, a failure in nf_hook_entries_insert_raw() prevents the system from unregistering and releasing NAT hooks when the insertion fails, resulting in a memory leak that steadily consumes kernel memory. This represents an improper resource management flaw that can compromise system stability by exhausting available memory.

The flaw affects all Linux kernel versions that include the nf_nat module and have not yet applied the patch introduced in the recent commits; because the CPE entry covers all Linux kernel builds, any system running an unpatched nf_nat implementation is in scope.

The CVSS score of 5.5 denotes moderate severity, and an EPSS score below 1 % indicates a very low probability of exploitation; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or requires privileged execution, as an attacker must either load a kernel module that triggers the fault or craft network traffic to provoke a hook insertion failure.