The Linux kernel conntrack action module (act_ct) can suffer a use‑after‑free when a packet with an unconfirmed conntrack entry is cloned. The first clone commits, wiring the extension pointer; the second clone subsequently modifies the same extension, breaking the pointer in the expectation list. During cleanup the broken pointer is dereferenced, leading to a fault in kernel memory. This fault may result in a kernel panic or other memory corruption but is not reported to allow privilege escalation directly.

All systems running the Linux kernel that have the act_ct conntrack action module enabled are potentially affected. No specific kernel version is cited in the advisory, implying that any kernel prior to the patch that includes the reset of unconfirmed entries upon cloning is at risk.

The CVSS score of 7.8 classifies the vulnerability as high. The EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to cause a packet to be processed twice—once before and once after cloning—within the same network zone and without header or zone changes, a condition that is difficult to engineer in typical environments.