The vulnerability is a use‑after‑free in the Linux kernel’s conntrack action (act_ct). When an unconfirmed conntrack entry is cloned, both clones may modify the shared extension pointer, leaving one clone with a dangling pointer that can be accessed during cleanup. This can lead to memory corruption, kernel panic, or, in theory, elevation of privileges if an attacker can control the packet processing flow.

It impacts all systems running the Linux kernel with the act_ct conntrack action module enabled. No specific kernel versions are listed, so any kernel that has not yet incorporated the patch to reset unconfirmed entries after cloning may be vulnerable.

No CVSS score, EPSS, or CISA KEV listing is provided, indicating limited public exploitation data. The exploit requires injecting cloned packets into the conntrack path, which is uncommon in normal network traffic but could be achievable in specialized or misconfigured environments. Given the patch already exists in the kernel source, the current risk is considered low to moderate until an attacker reliably triggers the VUAF path.