A use‑after‑free bug was discovered in the Linux kernel’s net/sched: act_ct helper. When a connection helper is called before all extensions are added, reallocation of the extensions area leaves a stale pointer in the expectations list. Later, when the expectation is removed, that invalid pointer is accessed, corrupting kernel memory. The patch ensures helper calls occur only after all extensions are added, preventing the stale reference.

The vulnerability is present in any Linux kernel that implements the nf_conntrack helper functionality within net/sched. All standard Linux distributions that run a kernel before the fix are affected. The CPE string provided indicates the generic Linux kernel product.

The CVSS score is not supplied, but a use‑after‑free in kernel space is considered high severity because it can crash the system or provide a foothold for privilege escalation. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV. Attackers could trigger the bug by sending crafted network traffic that activates the nf_conntrack helper, making the attack vector likely remote network-based. The lack of an exploit probability score does not diminish the need for remediation.