A use‑after‑free bug was found in the Linux kernel’s net/sched act_ct helper. The bug occurs when a helper is called before all extensions are added; a subsequent reallocation of the extensions area leaves an invalid pointer in the expectations list. When the expectation is later removed, that stale pointer is accessed, corrupting kernel memory. The patch ensures helpers are invoked only after all extensions are added, eliminating the stale reference.

All Linux kernels that implement the nf_conntrack helper feature in net/sched are affected, including mainstream distributions that run an unpatched kernel. The CPE string confirms that the vulnerability applies generically to the Linux kernel product.

The CVSS score of 7.8 indicates high severity. Use‑after‑free in kernel space can crash the system or provide a foothold for privilege escalation. The EPSS score of < 1% suggests that, although exploitation is unlikely, it remains a concern. The vulnerability is not listed in CISA KEV, but remediation is still warranted. Attackers could potentially trigger the bug by sending crafted network traffic that activates the nf_conntrack helper; the likely attack vector therefore is remote network‑based. Based on the description, it is inferred that network traffic can trigger the helper and may lead to exploitation, though the CVE does not explicitly state the vector.